Skip to content

Cyber Threats: Rise In Prevalence, Rise In Costs

Threat Surfaces Are Expanding

The proliferation of devices requesting access to the network, driven largely by the adoption of BYOD policies and utilization of IoT devices, has forced network security teams to be more diligent about setting and enforcing effective access control policies. Despite best efforts, attempts to address this evolving problem are akin to putting a finger in the dike – rogue devices inevitably slip through the cracks, leaving corporate networks vulnerable to ransomware and countless other cyber threats.

What’s more, network complexity complicates the issue. Today, networks consist of an ever-increasing number of WANs, LANs, VLANS, SD-WANs, MPLS, VPNs, employees’ homes, coffee shops, hotels, airports – wherever authorized devices can connect to gain access to company resources. As if the industry needed another acronym – some are calling it Bring Your Own Network (BYON). Regardless of how we define the trend, access to everything (from everywhere) has changed the security dynamic.

The impact on corporate bottom lines is tangible. The risks and costs associated with network breaches are growing larger by the year. It seems as if every day a new Fortune 500 company is reporting a costly cyberattack. Data breaches from January through September 30, 2021 (9 months), exceeded the total number of events in the entire year of 2020 by 17% (1,291 breaches in 2021 compared to 1,108 breaches in 2020). Adding to the challenge, threat actors are becoming more sophisticated and prevalent, leaving organizations on their heels fighting to catch-up.

A New Age of Cyber Threats

Cyber threats have become alarmingly prevalent, with malware increasing 358% overall and ransomware increasing 435% in 2021 compared with 2019. All threats, from phishing to attacks on Internet of Things (IoT) devices and supply-chains, have grown exponentially. Attacks on IoT devices tripled in the first half of 2019 and supply chain attacks were up 78%.

Costs have escalated in tandem. The average ransomware payment rose 33% in 2020 over 2019, to $111,605. The total cost of cybercrime for each company increased 12% from $11.7 million in 2017 to $13.0 million in 2018. Data breaches cost enterprises an average of $3.92 million annually.

In an attempt to mitigate these costly risks, many companies have opted to deploy niche solutions and tools such as network and host intrusion detection, various threat intelligence feeds, and mobile device management. While useful in isolation, these disparate tools (e.g., Network Performance Management, SIEM, XDR, SOAR, etc.) create many different panes of glass, leaving gaps in network security and complicating IT infrastructures.  All this means extra work for already thinly-stretched IT teams. In this sense, less really is more.

Essential Areas of Cybersecurity

The cybersecurity software market is oversaturated with tools that have been designed for very siloed tasks. Many of these have been developed in direct response to new threats, and require a certain focus and sophistication that doesn’t lend itself to the average IT professional’s chaotic daily life. Instead, companies need to develop a simple, yet solid security foundation that consists of three essentials:

  1. Firewalls to monitor incoming and outgoing network traffic
  2. Network access control to enforce access policies, assess connected device risk and remediate non-compliant devices
  3. Endpoint protection like antivirus to prevent, scan, detect and eliminate malware and other viruses from devices

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。

Advice on camera and microphone in WSL2 Ubuntu

At the time of writing these lines, almost everything we connect to our devices is through the so-called Universal Serial Bus (USB): cameras, microphones, external storage… It’s the fastest and safest way to synchronize and backup information between our mobile phone and computer! But what does all this have to do with the Windows Subsystem for Linux (WSL2 Ubuntu)? Let’s have a look.

Study in WSL2 with Ubuntu: proprietary and free software

To begin with, I will leave you a link to an article published in this blog, in order to facilitate knowledge of the technology I will be discussing. I will add more of them throughout the text. We have quite a bit to go through, so I recommend a nice, steaming cup of black coffee in your hands before we start.

*The Last tests I have carried out have been on virtual machines (VirtualBox®: they may be created, erased, modified, etc. on Solid State Drive).

Brief retrospective

I always say that “in order to know where we are going, we need to know where we come from.” Since 1989, I have worked with the products sold by the Microsoft Corporation: first the MS-DOS operating system and its only form of command-line interaction, and then Microsoft Windows, which also uses the graphical environment. Yes, I am well aware, MS-DOS® as such was eliminated, but its commands remain. It was replaced with Powershell®, which we have already talked about, and it is important for today’s topic.

At the end of 2016, Microsoft surprised us with the news that its SQL Server® could be run on GNU/Linux. For me, who for many years worked installing and maintaining data servers for my clients, this was shocking news. But wait, there’s more, on my journey, I discovered that   BASHware can affect a Windows system via WSL. Which brings us to today’s article, where we’ll go into handling USB devices, with particular attention to microphones and webcams, under WSL2 with Ubuntu 20.04.

WSL and WSL2

I recommend, again, the excellent article on WSL2. Although time has passed and there are some significant changes. At that time, WSL2 was installed by means of commands. Now, and I want to emphasize it, I notice that by MS Windows Control Panel, “Programs and Features”, we can add the two key components that are Virtual Machine Platform and obviously Windows Subsystem for Linux in the section of “Turn Windows features on or off”:

After this, the operating system must be restarted, this is already an idiosyncrasy of the house of Redmond! (There will be many more resets later that I will leave out. They will be implied.)

Another aspect that was added in July 2021 is the possibility of adding the Linux distributions that one wishes, directly, through the command line in Powershell (depending on the version and type of MS Windows that you have installed).

To see the available distributions:

wsl --list --online

To install Ubuntu 20.04:

wsl --install -d Ubuntu-20.04

After some time, depending on your Internet download speed, it will ask for username and password. It will immediately display the status of updates for Ubuntu.

To set WSL2 as default:

wsl --set-default-version 2

The option to download and use from the Microsoft Store is still valid and available, for Ubuntu 20.04 it takes almost half a gigabyte of space.

The fundamental difference between WSL and WSL2 is that the latest download is a complete Linux kernel, but not just any kernel, it is one specially designed to be coupled with the Windows kernel. This means that applications running on WSL2 will always have to be “passed through” -but not interpreted, as it was in WSL- before interacting with any hardware, USB included.

The only thing WSL does better than WSL2 is file sharing between the two operating systems. Apart from that, WSL2 offers many more advantages and improvements in WSL2.

Podman in WSL2

To give you an idea of how useful it is to include a full Linux kernel in MS Windows, the Podman software (Docker’s successor) can be run on WSL2. If you still don’t know what Podman is, make more coffee and read another of our articles.

Developer mode

A feature that Powershell offers that you may use to your advantage, once you have installed and configured WSL2, is the developer mode. It is accessed by pressing the Windows start key, typing “Powershell” and choosing the developer settings. The first thing is to activate the developer mode and wait for the necessary software to finish installing.

This consists of two main components: 

  • Device Portal.
  • Device Discovery.

The Device Portal will open port 50080 (remember to properly configure the Windows Defender Firewall), and from any web browser you may enter the configured credentials and access a variety of aspects that you can see in the following image.


*There is a tutorial for establishing safe connections with HTTPS but it is irrelevant for this article:

Differences aside, this is similar to what eHorus offers for both basic and advanced monitoring, if used together with Pandora FMS. I have included this feature because the configured credentials are required for the next point.

The second component is Device discovery which, among other aspects, will open an SSH server to make a connection. 

This allows us to open a terminal with the Windows command line and, once there, you may directly use WSL2 for any task that you need to develop remotely from another computer. In this case, as an example I used the PuTTY software to connect from the real machine to the Windows 10 virtual machine with WSL2 installed and configured: 

As you can see, once the default configuration has been established, just by typing the command wsl you will be ready in a Linux environment, not GNU/Linux but MSW/Linux.

USB in WSL2

We come to the purpose of this blog post: USB handling in WSL2. At the time of writing these lines, there are two pieces of news, one bad and one good.

  • The bad news is that no, WSL2 is currently unable to support USB, so for example your USB connected cameras and microphones will not be available to be used from WSL2.
  • The good news is that you may compile your own Linux kernel for WSL2 and have access to the occasional microphone or webcam from your chosen Linux distribution. But what applications could you use for it?

Compiling Linux kernel for WSL2

Before doing anything, first update Ubuntu WSL2 with the usual commands:

$ sudo apt update

$ sudo apt upgrade

And if you thought that this was enough software download… well not, now what I call the programming environment (dependencies) must be installed:

$ sudo apt install build-essential flex bison libssl-dev libelf-dev

And now you may download the base kernel source code for Ubuntu on WSL2:

$ sudo git clone https://github.com/microsoft/WSL2-Linux-Kernel.git

There are three gigabytes to download. The source code. Awesome.  Although you may always use the parameter git clone -depth=1<repository>, I did not use that option. I recommend at least 100 gigabytes free in storage before going into the downloaded folder (cloned repository) and running:

$ make -d KCONFIG_CONFIG=Microsoft/config-wsl

At this point I must clarify that I found many configuration options to compile. For example, to install the software for handling Snap packages on Debian. However, all this is excluded from Microsoft support, nothing you will be able to complain to this company if something goes wrong in the compilation process.

To finish off, turn off WSL2 with the command wsl –shutdown and copy the newly compiled kernel in the following way, not without first backing up the original kernel:

C:\Windows\System32\lxss\tools\kernel

At this point you should be able to connect any microphone or webcam and have access from WSL2… But it’s going to be no. It turns out that you must first get the hardware drivers for MS Windows, obviously, and then the Linux ones, enter in the source code the latter and recompile again. In addition to that, install in Ubuntu WSL2:

sudo apt install linux-tools-5.4.0-77-generic hwdata

sudo update-alternatives --install /usr/local/bin/usbip usbip /usr/lib/linux-tools/5.4.0-77-generic/usbip 20

And by the way, it must also be installed on Windows, with an MSI installer package, the USBIPD-WIN project…

As we can see, since we have gotten used to the graphical simplicity of Windows, if you disable the USB through the Device Manager, no hardware will be able to connect with or without your consent, since it will be blocked at operating system level.

Installing graphical applications in WSL2

Finally, although in the case of the snap package installer it is explicitly unsupported in Ubuntu over WSL2, other applications that interact with hardware (such as sound, for example) will be able to be installed, but when they try to access files of hardware (remember that in Linux everything is a file) because they simply will not find such resources. This is the case of the espeak software:

In theory, the Ubuntu blog indicates that by means of X Window System Architecture it is possible to “pass” the graphical interface of the applications installed in WLS2. Microsoft officially announced just before the end of 2021 that the following graphics applications can be run:

  • Gedit (my favorite graphical GNU text editor).
  • GIMP (powerful for graphic design).
  • Nautilus (file explorer).
  • VLC (audio and video player).
  • Applications based on X11 (calculator, clock, etc.).
  • Google Chrome (at your own risk due to its high RAM and resource consumption).
  • Microsoft Teams (by the way, Pandora FMS has a special connector).
  • Even Microsoft Edge web browser for Linux!

But this has some drawbacks. First, you must have Windows 11 Build 22000. Second, have the video hardware drivers for WSL2 installed. Third, be enrolled in the Windows Insider Program. I hope you liked the information!

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

What is Vulnerability Prioritization?

In an ideal world, security teams would remediate all vulnerabilities as soon as they are discovered, eliminating both small and large risks. However, zero inboxing in the world of vulnerability management is a mere pipe dream. 

Continue reading
×

Hello!

Click one of our contacts below to chat on WhatsApp

×