Skip to content

ESET removes Social Media Scanner from product portfolio due to restrictions on third-party API applications

BRATISLAVA – ESET, a global leader in cybersecurity, has removed the ESET Social Media Scanner from its product portfolio. The API-based application was initially designed to protect users from malicious content distributed through Facebook, Twitter and VKontakte and sat alongside ESET’s software solutions. Due to increased restrictions on third-party API applications, the removal of Facebook protection and the strengthening of Twitter’s built-in security, the application will be from August 4, 2020 no longer available.

User security and safety when accessing social media platforms is paramount. During its existence, ESET Social Media Scanner secured more than 135 billion links and identified over 12 million threats in social media content, including malicious links and downloads. ESET is dedicated to providing consumers with the highest level of protection and is constantly adapting its solutions to the current cybersecurity and threat landscape.

Now, ESET Internet Security offers cutting-edge internet protection that steps in to addresses threats vectoring from social media. The solution provides users with advanced protection against internet threats using ESET’s renowned multilayered antivirus technology and privacy protection. This multiplatform protection is delivered under one license to ensure comprehensive protection.

In addition to robust cybersecurity solutions, ESET provides a wealth of online resources in order to educate users on cybersecurity best practices and how to stay safe online. While ESET Internet Security continues to protect users from malicious content online, it is vital that people are vigilant with their social media safety. If you are concerned that your Twitter account has been compromised, head to We Live Security to follow our expert’s advice on Twitter safety.

Marek Demín, Product Manager at ESET, commented, “At ESET, we are consistently evaluating our product offering to ensure consumers are equipped with the highest levels of protection. Central to our core mission in helping users enjoy safer technology is staying one step ahead of the latest threats and offering modern, cutting-edge solutions. This is why we have renewed our focus on our Internet Security offering, which provides users with comprehensive internet protection through one secure solution. Whether you’re browsing the web, doing online banking or using social media, we are dedicated to providing a safe and secure online experience for all.”

Learn more about ESET Internet Security here.

 

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

SCADAfence Researchers Discover a Vulnerability in Mitsubishi Electric MELSEC iQ-R Series CPU DoS

As part of our mission to secure the world’s OT, IoT and Cyber Physical infrastructures, we invest resources into offensive research of vulnerabilities and attack techniques.

CVE-2020-13238 is a remote CPU DoS vulnerability in Mitsubishi Electric iQ-R Series that has been discovered by SCADAfence researcher Yossi Reuven.

Mitsubishi Electric is one of the world’s leading electronics and electrical equipment manufacturing companies, and is in use by many of our customers. We have been working with Mitsubishi Electric for the last few months in handling this vulnerability, and on June 9th, Mitsubishi Electric published an official security advisory reporting this vulnerability and mitigations.

CVE-2020-13238

MELSEC iQ-R Series is Mitsubishi Electric flagship product line – design for high productivity automation systems. iQ-R CPUs’ communication with GX Works 3 (Engineering software package) is done via Mitsubishi Electric proprietary protocol MELSOFT (which works on both TCP and UDP). 

When an attacker sends a short burst of specially crafted packets over the MELSOFT UDP protocol on port 5006, which causes the PLC’s CPU to get into fault mode, causing a hardware failure (error code: 0x3C00 – hardware failure). The PLC then becomes unresponsive and requires a manual restart to recover.

What SCADAfence Recommends Vendors To Do

Upgrade to the Latest Firmware

Most of Mitsubishi Electric’s iQ-R Series PLCs are not running on the firmware versions later than Version 40. In addition, automation engineers don’t usually upgrade to the latest firmware, which can lead to their PLCs being exposed to a DoS (denial of service) attack. Upgrading to the latest firmware (Version 49) can prevent this attack from happening.

Block UDP Port 5006 and Use MELSOFT TCP

MELSOFT is an engineering software for Mitsubishi PLCs and gives users the option to use either the (connectionless) UDP and (connection-oriented) TCP protocols for programming and configuring the devices. SCADAfence recommends to block Block UDP port 5006 since the cyberattack leverages the connectionless UDP protocol and can cause the PLCs to stop functioning and cause a denial of service. Instead, users should use the TCP protocol for communicating with devices in the shop floor or the control network.

Special Thanks & Recognition

The SCADAfence Research team would like to thank the Mitsubishi Electric team for a speedy vulnerability reporting process even during the challenging COVID-19 times.

SCADAfence is committed to continued research of offensive technologies and development of new defensive technologies.

Exploit PoC

We wrote a Python POC (GPLv3) script of the exploit in action. You can download it for free and use this for educational / research purposes.

Warning: The script will crash the PLC’s CPU – don’t use in production.

To get this free python script, please send an email to christoph@scadafence.com

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About SCADAfence
SCADAfence helps companies with large-scale operational technology (OT) networks embrace the benefits of industrial IoT by reducing cyber risks and mitigating operational threats. Our non-intrusive platform provides full coverage of large-scale networks, offering best-in-class detection accuracy, asset discovery and user experience. The platform seamlessly integrates OT security within existing security operations, bridging the IT/OT convergence gap. SCADAfence secures OT networks in manufacturing, building management and critical infrastructure industries. We deliver security and visibility for some of world’s most complex OT networks, including Europe’s largest manufacturing facility. With SCADAfence, companies can operate securely, reliably and efficiently as they go through the digital transformation journey.

後防疫時代非接觸性生物辨識需求升溫 訊連科技FaceMe®推出口罩偵測及臉部辨識解決方案

2020610日,台北訊】 AI臉部辨識技術領導廠商訊連科技(5203.TW)宣布,旗下FaceMe® AI臉部辨識引擎推出兩項全新功能,包括偵測是否配戴口罩、及於戴口罩時進行人臉辨識,此兩項技術將應用於所有智慧物聯網場域,包括醫療、零售、門禁、安控、辦公大樓的「後防疫時代」防護控管及人員控制等解決方案。

近日新冠肺炎疫情趨緩,商業活動已逐步復甦,出入醫院、商場等公共場所時,仍建議配戴口罩及保持適當社交距離。FaceMe®AI臉部辨識引擎全新的口罩偵測功能可透過AI技術,偵測及判別人員是否配戴口罩,或口鼻露出、使用其他物品遮住口鼻等非正確配戴狀況。FaceMe®可辨別醫用口罩、 N95口罩、布口罩等各式口罩,並可辨識不同臉部角度下之口罩配戴狀況。

 此外,人員進出必須配戴口罩之場所,如醫院、廚房、公共運輸等,FaceMe®也可於配戴口罩後進行臉部辨識及身分確認,準確率達95%以上,可大幅減少刷臉時須取下口罩之風險及不便。

「受到疫情影響,指紋辨識、靜脈辨識等接觸性生物辨識因有接觸風險,已被非接觸性生物辨識取代。而與需要特殊硬體及近距離使用的虹膜辨識相比,臉部辨識技術具備準確、彈性、安全等優勢,成為非接觸性生物辨識之主流技術。」訊連科技黃肇雄執行長表示:「因應後防疫時代的口罩配戴措施,FaceMe®口罩偵測及戴口罩臉部辨識等功能,可提供智慧物聯網廠商及系統整合商完整的解決方案,廣泛應用於醫療、零售、門禁等場景。」

 FaceMe®是專為邊緣運算裝置開發的臉部辨識引擎,擁有高達99.70%的辨識率。在全球知名NIST臉部辨識競賽中,名列全球最精準且最快速的刷臉技術之一,也是台灣表現最佳之廠商。除了支援功效強大的工作站或個人電腦,亦可針對IoT/AIoT物聯網設備中的輕量、低功耗設備進行優化。本次推出口罩相關功能, FaceMe®精確、即時及安全的特性也獲得更廣泛的實務應用。

除了口罩相關應用,訊連科技也預計於第三季陸續推出整合熱感攝影機的體溫檢測、及AI人數統計等功能,可進一步為後防疫時代的安控、零售及醫療等相關應用提供一站式的智慧解決方案。

更多訊息,請參考FaceMe®官方網站(https://tw.CyberLink.com/FaceMe),或透過電子郵件(FaceMe_TW@cyberlink.com)與訊連科技業務單位聯絡取得試用。

About Version 2

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

關於CyberLink
訊連科技創立於1996年,擁有頂尖視訊與音訊技術的影音軟體公司,專精於數位影音軟體及多媒體串流應用解決方案產品研發,並以「抓準技術板塊,擴大全球行銷布局」的策略,深根台灣、佈局全球,展現亮麗的成績。訊連科技以先進的技術提供完美的高解析影音播放效果、以尖端的科技提供完整的高解析度擷取、編輯、製片及燒錄功能且完整支援各種高解析度影片及音訊格式。產品包括:「威力導演」、「PowerDVD」、「威力製片」、「威力酷燒」等。

ASRC 2020 年第一季電子郵件安全趨勢

2020年第一季過得十分不平靜,讓世界各國都繃緊神經的話題,莫過於防疫相關問題。不論是疫情的擴散速度、防疫保護的措施,抑或是物資採買、捐贈等都是被熱烈討論的話題。正當實體世界疫情蔓延時,網路世界同樣受到疫情波及,駭客利用大眾對疫情的關注假藉新冠肺炎發動攻擊。ASRC 研究中心 (Asia Spam-message Research Center) 在2020年第一季觀察到幾個值得注意的郵件安全議題:

遠端工作模式成為駭客攻擊目標,造就各種詐騙氾濫
2020第一季,全球在新冠肺炎影響下,保持「社交距離」改變了人類生活接觸的方式。許多企業為保住服務與業務能量,在可行的情況下紛採行在家上班的工作模式。這樣的工作模式帶來了下列的影響:
.網路流量的需求在短時間劇烈上升
.遠端連線、遠距會議、VPN的需求大增
.人們直接見面接觸的情況大幅下降
這些影響,可能會帶來針對遠端作業軟體的攻擊嘗試,以及各種詐騙的氾濫。

病毒郵件相較上季增加 340%、詐騙郵件爆增 400%
根據 ASRC 研究中心 (Asia Spam-message Research Center) 的觀察,第一季的整體郵件量微幅上升,尤其是新冠肺炎對全球影響最劇烈的三月份;病毒郵件量則明顯激增,相較於上一季,大約增加了340%,增加幅度最高也是在三月;詐騙郵件的數量在本季也較上季增加約400%。

藉名新冠肺炎的攻擊,目的以詐財或入侵企業為大宗
在疫情逐漸蔓延的第一季,許多攻擊也藉著疫情之名,試圖誘騙收件者開啟惡意攻擊郵件。這些假藉疫情之名的攻擊郵件,其主旨多半會帶上cdc、covid、corona、spread這些關鍵字眼。
以目的來說,數量最大宗的為詐騙郵件,多半假藉研究或衛生單位,以研究或幫助世界的名義,請求收件人捐錢;當然也有詐騙郵件誆稱可購買疫苗或篩檢試劑,一樣是以詐騙金錢為目的。

募款購買防疫物資的詐騙郵件

另一種目的則是試圖透過電子郵件嘗試入侵企業單位內部,以利進行後續的竊資、部署勒索軟體等目的。這類攻擊,多半直接寄送可利用Office漏洞的惡意文件,並以疫情相關主題誘騙收信人開啟,試圖藉此提高攻擊成功機率。經統計,此類型攻擊常用的漏洞編號為:CVE-2012-0158、CVE-2017-11882、CVE-2017-0199以及CVE-2017-8570。

冒名CDC的通知,事實上為一可利用CVE-2017-11882漏洞的惡意文件

在 2020 年 3月,有大量以covid、corona相關的域名被註冊,這些域名被用於販賣新冠病毒保健品與檢測試劑,這些販售網站可能都是臨時設立,其販售物多半是不合法的贗品。其他無附件檔的惡意郵件多半都夾帶了一個以上的超連結用於釣魚,或是以超連結的方式,誘騙收件者下載遠端的惡意程式並執行。

偽裝的附檔以超連結的方式,誘騙收件者下載遠端的惡意程式並執行

為避免新冠肺炎群聚感染導致企業單位所可能出現的人力損失,遠距上班是普遍採取的應對措施。由於作業方式改變,彼此見不到面、資訊傳遞的塞車、中間人的竊聽,就可能出現冒名的號令 (假冒老闆要求通訊錄、匯款、合約、訂單…);攻擊者也利用此波疫情,搭配社交工程攻擊的手法,進行財務相關的詐騙或入侵攻擊,比方:Emotet銀行木馬…等。新冠肺炎對於全球來說,可說是如黑天鵝般,大家未能預期它的出現,也不相信他的感染範圍可與1918年西班牙流感匹敵,但新冠肺炎的嚴重性,從大家的懷疑慢慢地變成了現實。資訊安全呢?我們可以看見資訊安全所帶來的可能性衝擊,它就如同灰犀牛般,若我們忽視,則可能隨時遭到猝不及防的攻勢或損失!

>> ASRC 2020 年第一季電子郵件安全趨勢 檔案下載

About Version 2

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

關於中華數位科技 Softnext Technologies Corp.
創立於2000年8月。
秉持著【We Secure Your Content】的服務理念,以提供企業資訊應用管理服務及打造資訊內容安全防護為宗旨。專精於提供網路應用服務技術,根據市場需求推出多款資訊內容安全的解決方案及應用服務,能夠協助企業透過符合資安管理規範並遵循法規的方式進行資訊內容安全管理,以維護員工的生產力、提升企業經營績效。

關於 ASRC 垃圾訊息研究中心
ASRC 垃圾訊息研究中心 (Asia Spam-message Research Center),長期與中華數位科技合作,致力於全球垃圾郵件、惡意郵件、網路攻擊事件等相關研究事宜,並運用相關數據統計、調查、趨勢分析、學術研究、跨業交流、研討活動..等方式,促成產官學界共同致力於淨化網際網路之電子郵件使用環境。更多資訊請參考 www.asrc-global.com .

WannaCryptor爆發至今,已屆滿三年,卻仍然威脅全球

2017年5月12日,WannaCryptor(也稱為WannaCry和WCrypt)對全球電腦系統造成了前所未有的嚴重破壞,其利用Windows SMB的漏洞進行類似蠕蟲的主動式傳播行為,導致只要在區域網路中有一台主機中勒索病毒,會主動掃描區域網路中其他主機是否開啟445通訊埠,然後利用先前遭到外洩的美國NSA攻擊程式EternalBlue進行弱點滲透攻擊。

根據2020年第一季的ESET資安威脅報告,WannaCryptor依舊活躍並位居最常檢測到的勒索軟體之榜首,佔勒索軟體檢測到的40.5%。儘管它比上個月下降了不到一個百分點,但它在榜首的主導地位也沒有在4月消停。自2017年5月最大的爆發以來,至今已屆滿三年,其活躍程度著實令人十分不安,在2020年第一季的大部分時間裡,WannaCryptor的檢測歸因於廣泛認可的樣本,而這些樣本分佈於存在可能大量未更新設備的地區,例如土耳其,泰國和印尼。

圖1. 2020年1月至2020年4月前十名的勒索軟體排行榜(勒索軟體檢測的佔比)

導致整個WannaCryptor危機的漏洞:EternalBlue,在2020年第一季呈下降趨勢,但即便如此,EternalBlue仍具威脅,據Shodan稱,仍有大約一百萬台Windows設備使用SMBv1協議(請參考圖2),而這也意味著可能這一百萬台電腦將受到EternalBlue漏洞的攻擊。
*Shodan 是一個網路搜尋引擎,專門用來搜尋連上網際網路的各種裝置。Shodan 可搜尋的裝置和系統包括:網路攝影機、嬰兒監視器、醫療設備、工業控制系統 (ICS) 裝置、家用電器,以及資料庫等等。Shodan 會蒐集、彙整連網裝置所公開的一些基本資料和資訊,讓任何人都能輕易搜尋。

圖2. Shodan數據(截至2020年5月4日)

根據<圖2>顯示,今年美國依舊是擁有易受攻擊設備數量最多的國家,而俄羅斯則超過日本位居第二,值得關注的是南非,因為去年(2019年)它並沒有出現在名單上,現今卻排名第四。

除了WannaCryptor外,Diskcoder.C(又名Petya,NotPetya和ExPetya)和BadRabbit也都是利用EternalBlue漏洞進行攻擊的勒索軟體,但其實該漏洞早在WannaCryptor全球爆發前59天(2017年3月14日),微軟就已公佈了Windows系統修復修補程式,請用戶更新;儘管您可能認為WannaCryptor應該給大家提供了很寶貴的教訓,但不幸的是,事實並非如此….從去年(2019年)年中開始,網路安全專家就開始對BlueKeep發出警報,BlueKeep是遠端桌面協定(Remote Desktop Protocol,簡稱RDP)中發現的一個遠程代碼執行(RCE)漏洞,也提醒用戶應盡快修補漏洞、進行更新,而同年11月更爆發了針對BlueKeep漏洞的系統之首波攻擊。

結論
三年過去了,面對勒索病毒或資安威脅,擁有資安危機意識及積極的解決是很重要的,預防措施永遠更勝於後續補救,ESET資安產品及企業解決方案能主動偵測已知(如WannaCryptor、Petya)、未知病毒及勒索軟體,抵禦網路攻擊或資安威脅,協助您打造良好的資安環境。

原文出處:www.welivesecurity.com/2020/05/12/wannacryptor-remains-global-threat-three-years-on/

  

About Version 2

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

關於ESET
ESET成立於1992年,是一家面向企業與個人用戶的全球性的電腦安全軟件提供商,其獲獎產品 — NOD32防病毒軟件系統,能夠針對各種已知或未知病毒、間諜軟件 (spyware)、rootkits和其他惡意軟件為電腦系統提供實時保護。ESET NOD32佔用 系統資源最少,偵測速度最快,可以提供最有效的保護,並且比其他任何防病毒產品獲得了更多的Virus Bulletin 100獎項。ESET連續五年被評為“德勤高科技快速成長500 強”(Deloitte’s Technology Fast 500)公司,擁有廣泛的合作夥伴網絡,包括佳能、戴爾、微軟等國際知名公司,在布拉迪斯拉發(斯洛伐克)、布裏斯托爾(英國 )、布宜諾斯艾利斯(阿根廷)、布拉格(捷克)、聖地亞哥(美國)等地均設有辦事處,代理機構覆蓋全球超過100個國家。

×

Hello!

Click one of our contacts below to chat on WhatsApp

×