Skip to content

Greater than Biblical Genesis: Tentacle Protocol Genesis

Everything Has a Beginning: The Genesis of Tentacle Protocol

You probably know all kinds of remarkable “genesis”: the biblical and canonized, where Adam and Eve have their first Tinder date, the British rock band from the 60s with excellent Peter Gabriel on vocals and Phil Collins on drums, and of course, the Hyundai Genesis, a passenger car manufactured by the South Korean brand Hyundai Motor Company since 2008… But this time, none of them interests us. We’ll leave the trunk capacity of the Hyundai for another day, but not today, today, in our ominous and greenish Pandora FMS Blog, we will talk about an even more important genesis for the history of the beginnings and the startings (drum roll), the beginnings of Tentacle Protocol.

And to talk about the origins of Tentacle Protocol, we had to make an effort to find our colleague Ramón Novoa Suñer, Head of the AI department and Senior Chief Programmer at Pandora FMS, a hero for the company, who has been here for as many years as it exists and that, therefore, houses all the possible knowledge on the matter, right within its experienced and ancient testa.

To find Ramón, we had to undertake a dangerous journey, crossing the icy glacier and the burning desert, traveling day and night without rest, risking our life and our physique, crossing the most spectral swamps and mountain slopes, enduring merciless winds, to finally reach the medieval fortress where he was, always involved in his chores and completely oblivious to the admiration that the world professes him.

Proposing an interview with Ramón was easy, but it took time to carry it out, that’s why I stayed with him as an apprentice. I slept in the highest tower of the castle and devoted myself to absorbing all kinds of technological knowledge that got thrown on me to the ground like little bones. I didn’t want to waste a second spent with him. After all, he is one of the most recognized geniuses in his field. The Dumbledore of programming.

Weeks passed, then years, but finally the long-awaited interview about the origin of the Tentacle Protocol that I longed for and that led me there came. Now I want to share it with you on this blog, as I ride away from the fortress as the voice of Master Ramón still resounds in my head:

Oh Master, what year would you say it was when the Tentacle Protocol was invented?

* Hmm … 2008, if I’m not mistaken, because by now it’s already been a few years… I would say shortly after I finished my degree and started working at Ártica. It still seems to me that it was yesterday, and here we are, more than a decade and a pandemic later…

*Important remark: All of the answers that Ramón gives us, should resonate in your head with the deep voice of a wise hermit, if not, you’re not reading this the right way.

¿Where does that science fiction name come from?

I’m very glad that you asked me that question, little Dim. You see, the Pandora FMS logo at that time was an octopus, so the name seemed like the most appropriate, don’t you think so? It is also a tribute to a popular video game from the 90s. You don’t need me to give you more clues, right? Authentic and pure people, the ones who are really worth it, will know what video game I refer to.

Do you remember who was involved in the project from the beginning?

The idea of the project came from Sancho Lerena, the famous CEO, and I was the developer. Keep in mind that at that time there were only two programmers in Ártica ST. We still had absolutely no idea about the people who would join us in this dream.

From what did the idea of this protocol arise? What is its true origin?

Well, at the very beginning, Pandora FMS agents used SSH or FTP to send data to the server. But users had a lot of trouble configuring these protocols correctly. So we decided to develop a simple protocol that would work without no more additional initial configuration than that of the IP address and the port of Pandora FMS server. Helping and simplifying has always been the purpose of the Tentacle Protocol, and boy did it do well.

What exactly is the Tentacle Protocol?

It is a text protocol (like SMTP or HTTP) to transfer files. The specification is very simple, it is given in our Wiki, the most sacred group of texts that I know, it contains from the Alpha to the Omega of this organization. The Tentacle Protocol is less efficient than a binary protocol, but more readable and easier to debug. Giving it that magic that it has.

What is it for?

Basically send and receive files. The advantage it has, as I mentioned before, is that it is very easy to configure. You don’t even need to specify the destination directory. It also supports slightly more advanced features such as data compression or the use of X.509 certificates.

How important is it for Pandora FMS?

It is essential for transferring XML data files from agents and satellite servers to Pandora FMS server. It is also used to manage remote configuration, file collections, etc. Also, the Tentacle server can work as a proxy.

Is it true that in good hands and used in the right way it could save the world?

If the instructions to save it had to be sent through a TCP/IP stack, I have no doubt.

Let’s fantasize, if you could rename it now, what would you call it?

A) Metal Gear Solid Protocol: Solid Snake you are the boss.
B) Testicle Protocol
C) Tenta-cool protocol
D) Protocol A Feira

E) “Octopus” too, in reference to Doctor Octopus as well.

And that was it for my story of how I managed to find Ramón Novoa at the end of the world and have him explain everything about the genesis of the Tentacle Protocol. I will never forget his hospitality, his erudition, or how the monk’s habit that I wore throughout the training in technological knowledge, there in the tower, was constantly killing my waist.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

Number of APT groups exploiting the latest Exchange vulnerabilities grows, with thousands of email servers under siege, ESET discovers

BRATISLAVA, MONTREAL – ESET Research has discovered that more than ten different advanced persistent threat (APT) groups are exploiting the recent Microsoft Exchange vulnerabilities to compromise email servers. ESET has identified more than 5,000 email servers that have been affected by malicious activity related to the incident. The servers belong to organizations – businesses and governments alike – from around the world, including high-profile ones. Thus, the threat is not limited to the widely reported Hafnium group.

In early March, Microsoft released patches for Exchange Server 2013, 2016 and 2019 that fix a series of pre-authentication remote code execution (RCE) vulnerabilities. The vulnerabilities allow an attacker to take over any reachable Exchange server, without the need to know any valid account credentials, making internet-connected Exchange servers especially vulnerable.

“The day after the release of the patches, we started to observe many more threat actors scanning and compromising Exchange servers en masse. Interestingly, all of them are APT groups focused on espionage, except one outlier that seems related to a known coin-mining campaign. However, it is inevitable that more and more threat actors, including ransomware operators, will have access to the exploits sooner or later,” says Matthieu Faou, who is leading ESET’s research effort into the recent Exchange vulnerability chain. ESET researchers noticed that some APT groups were exploiting the vulnerabilities even before the patches were released. “This means we can discard the possibility that those groups built an exploit by reverse engineering Microsoft updates,” adds Faou.

ESET telemetry flagged the presence of webshells (malicious programs or scripts that allow remote control of a server via a web browser) on more than 5,000 unique servers in over 115 countries.

ESET hourly detections for webshells dropped via CVE-2021-26855 – one of the recent Exchange vulnerabilities

Proportion of webshell detections by country (2021-02-28 to 2021-03-09)

ESET has identified more than ten different threat actors that likely leveraged the recent Microsoft Exchange RCE vulnerabilities in order to install malware like webshells and backdoors on victims’ email servers. In some cases, several threat actors were targeting the same organization.

The identified threat groups and behavior clusters are:

  • Tick – compromised the web server of a company based in East Asia that provides IT services. As in the case of LuckyMouse and Calypso, the group likely had access to an exploit prior to the release of the patches.
  • LuckyMouse – compromised the email server of a governmental entity in the Middle East. This APT group likely had an exploit at least one day before the patches were released, when it was still a zero day.
  • Calypso – compromised the email servers of governmental entities in the Middle East and in South America. The group likely had access to the exploit as a zero day. In the following days, Calypso operators targeted additional servers of governmental entities and private companies in Africa, Asia and Europe.
  • Websiic – targeted seven email servers belonging to private companies (in the domains of IT, telecommunications and engineering) in Asia and a governmental body in Eastern Europe. ESET named this new cluster of activity as Websiic.
  • Winnti Group – compromised the email servers of an oil company and a construction equipment company in Asia. The group likely had access to an exploit prior to the release of the patches.
  • Tonto Team – compromised the email servers of a procurement company and of a consulting company specialized in software development and cybersecurity, both based in Eastern Europe.
  • ShadowPad activity – compromised the email servers of a software development company based in Asia and a real estate company based in the Middle East. ESET detected a variant of the ShadowPad backdoor dropped by an unknown group.
  • The “Opera” Cobalt Strike – targeted around 650 servers, mostly in the US, Germany, the UK and other European countries just a few hours after the patches were released.
  • IIS backdoors – ESET observed IIS backdoors installed via webshells used in these compromises on four email servers located in Asia and South America. One of the backdoors is publicly known as Owlproxy.
  • Mikroceen – compromised the exchange server of a utility company in Central Asia, which is the region this group typically targets.
  • DLTMiner – ESET detected the deployment of PowerShell downloaders on multiple email servers that were previously targeted using the Exchange vulnerabilities. The network infrastructure used in this attack is linked to a previously reported coin-mining campaign.

“It is now clearly beyond prime time to patch all Exchange servers as soon as possible. Even those not directly exposed to the internet should be patched. In case of compromise, admins should remove the webshells, change credentials and investigate for any additional malicious activity. The incident is a very good reminder that complex applications such as Microsoft Exchange or SharePoint should not be open to the internet,” advises Faou.

For more technical details about these attacks exploiting the recent Exchange vulnerabilities, read the blogpost “Exchange servers under siege from at least 10 APT groups” on WeLiveSecurity. Make sure to follow ESET Research on Twitter for the latest news from ESET Research.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

The Future of Network Security: Identity, Segmentation & Securing the Edge

What it takes to properly secure corporate networks in the world of remote work, BYOD & IoT

The workplace has changed thanks to COVID-19. Many of us continue to spend most, if not all, of our workdays at home, juggling Zoom meetings, kids, pets, relationships, cooking, cleaning…you name it. Since at least February 2020, organizations around the world have altered the way they operate – encouraging their employees to stay home, stay safe, but stay available.

On top of the immediate operational challenges that companies faced when shifting to full or hybrid work environments, the rise of remote work in response to COVID-19 has pushed a number of network security shortcomings to the surface. In response, cybersecurity vendors and IT professionals have accelerated the development of and search for solutions to fill these network security gaps.

As we return to the office and arrive in a post-COVID-19 world, these areas will dominate the evolutionary direction of corporate network security…

The Role of Identity

As people, we represent the weakest link in the network security armor. While we may wish we were infallible, we’re really full of bad cybersecurity habits, like weak passwords, forgetting to back up data, or clicking on hyperlinks in emails from strangers. Our identities, however, can also be our strongest means of securing networks. The rise of multi-factor authentication (MFA) identity and access management (IAM) tools is allowing organizations to verify employee identity and authenticate their access to the network in real-time, no matter the employee’s location or whether they’re attempting to connect with a managed or personal (BYOD) device.

Network Segmentation

Segmenting the network is a cybersecurity best practice. Period. For any companies, this practice is even a regulatory requirement (e.g., the Payment Card Industry data security standard (PCI)). Network segmentation is simply a means of dividing up a network into smaller parts, ensuring the right people only have access to the parts of the network that are relevant to them. It is a measure that improves the effectiveness of an organization’s investments in other security tools, and can help to prevent significant damage to critical data across the network after a company has experienced a breach.

Securing the Edge

Gartner introduced SASE a few years ago. It represents a new enterprise networking technology category that converges the functions of network and security solutions into a single, unified cloud service. This marks an architectural transformation, as it allows IT teams to leverage a holistic and flexible service to their businesses. Critical to this budding area is NAC. Specifically, the movement of NAC to the cloud eliminates expensive on-site hardware and hidden maintenance costs. With cloud NAC, like Portnox CLEAR, all that’s needed to control network access across a geographically dispersed network is an internet connection.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。

訊連科技將於「2021智慧城市展 Smart City Expo」登場 展示FaceMe®人臉辨識於安控、防疫、金融等解決方案

【2021年03月16日，台北訊】 世界級AI臉部辨識技術開發商訊連科技(5203.TW)將於2021年3月23日至26日於台北南港展覽館舉辦之「2021智慧城市展Smart City Expo」登場，展示最新的FaceMe® Security，可提供身分辨識、門禁管理、出勤、口罩偵測及體溫量測之一站式智慧安控及防疫解決方案。此外，亦於本展中展示專為金融保險業設計的FaceMe® eKYC & Fintech智慧金融解決方案，提供金融或保險業者，利用人臉辨識進行eKYC電子化的身分辨識服務。

訊連科技將於「2021智慧城市展 Smart City Expo」登場 展示FaceMe®人臉辨識於安控、防疫、金融等解決方案

近年來，人臉辨識技術快速進入智慧安控領域。FaceMe® Security解決方案可於現行安控系統中，快速導入人臉辨識功能，除可用作門禁或紀錄員工出缺勤紀錄外，更可辨別VIP或黑名單等特定人士。支援Milestone、Network Optix Nx Witness及VIVOTEK VAST2等VMS影像管理軟體，於偵測到特定人士時，可同步發送事件通知至VMS軟體，方便保全人員監控及管理。

FaceMe® Security於智慧安控場景中提供端對端的解決方案。於邊緣端運行的FaceMe® Security Workstation可運作於工作站、工業電腦及物聯網裝置上，進行即時的人臉偵測及特徵擷取，用作身分比對。以人流來說，於工廠或科技園區等每小時上萬人流的大型場域，可選擇於單一Windows工作站上安裝至多四張的NVIDIA Quadro RTX 5000加速卡。而以數千人的中小型場域，如辦公大樓、零售商場及倉儲，則可運行於NVIDIA Jetson （AGX Xavier或Xavier NX）或採用Intel® Core 處理器或Movidius™ VPU的工業電腦或NUC等設備，降低建置成本及功耗。針對門禁及防疫需求，FaceMe® Security可透過Health Add-On及Check-In Add-On兩款套件，於場域入口建置體溫、口罩偵測站及出勤打卡機。

金融保險業近年來積極布局的Fintech數位轉型，透過生物辨識進行的「eKYC電子化認識客戶」（Electronic Know Your Customer）成為Fintech熱門應用，其中人臉辨識有其相容性高、辨識準確度高及非接觸性等優勢，成為eKYC最主流技術。訊連科技推出的FaceMe® eKYC & Fintech 智慧金融解決方案 ，提供1:1人員核身（人證比對）與1:N身分辨識等功能，可應用於行動網銀、ATM無卡交易、行動投保與人員進出管理等，透過人臉辨識可更快速、安全的核實用戶身分，並將臉部特徵建檔供作後續服務應用。透過人臉辨識簡化身分認證流程，有效提升客戶體驗。

訊連科技FaceMe®人臉辨識引擎，在全球知名NIST人臉辨識評比中，準確度為扣除中、俄廠商後，全球排名第一的人臉辨識開發商。訊連科技將於於2021年3月23日至26日登場之「2021智慧城市展Smart City Expo」中，針對智慧金融、智慧安控和防疫需求，展示多項最新AI科技與應用解決方案。

2021智慧城市展 Smart City Expo
活動期間：110年 3 月 23 日（星期二）至 3 月 26 日（星期五），共四日。
展出時間：上午10時至下午6時 （最後一日參觀至下午5：00）
活動地點：台北南港展覽館2館1樓 (115台北市南港區經貿二路2號)
訊連科技攤位編號：Q701

關於Version 2

Version 2 Digital 是立足亞洲的增值代理商及IT開發者。公司在網絡安全、雲端、數據保護、終端設備、基礎設施、系統監控、存儲、網絡管理、商業生產力和通信產品等各個領域代理發展各種 IT 產品。透過公司龐大的網絡、通路、銷售點、分銷商及合作夥伴，Version 2 提供廣被市場讚賞的產品及服務。Version 2 的銷售網絡包括台灣、香港、澳門、中國大陸、新加坡、馬來西亞等各亞太地區，客戶來自各行各業，包括全球 1000 大跨國企業、上市公司、公用事業、醫療、金融、教育機構、政府部門、無數成功的中小企及來自亞洲各城市的消費市場客戶。

關於CyberLink
訊連科技創立於1996年，擁有頂尖視訊與音訊技術的影音軟體公司，專精於數位影音軟體及多媒體串流應用解決方案產品研發，並以「抓準技術板塊，擴大全球行銷布局」的策略，深根台灣、佈局全球，展現亮麗的成績。訊連科技以先進的技術提供完美的高解析影音播放效果、以尖端的科技提供完整的高解析度擷取、編輯、製片及燒錄功能且完整支援各種高解析度影片及音訊格式。產品包括：「威力導演」、「PowerDVD」、「威力製片」、「威力酷燒」等。

Scale Computing Delivers High-Performing, Efficient, and Scalable IT Infrastructure to Transportation Services Industry

INDIANAPOLIS – March 17, 2021 – Scale Computing, a market leader in edge computing, virtualization, and hyperconverged solutions, today announced continued momentum within the transportation industry, thanks to Scale Computing’s HC3, which allows transportation organizations — whether they are over-the-road, rail, marine, or air — to optimize operations with self-healing, automated infrastructure for all applications.

“The transportation industry has a lot of moving parts, from new CO2 emission rules to a fast-growing number of cyber-attacks. Transportation vehicles, vessels, and crew are vulnerable and require onboard computer infrastructure technology that is simple, secure, and resilient,” said Jeff Ready, CEO and co-founder of Scale Computing. “Our HC3 Edge Computing solutions optimize transportation operations with self-healing, automated infrastructure, ensuring application availability, simplified management and secure applications on all fleets, whether it is air, marine, over-the-road, or rail transportation.”

With the proper platform in place, transportation entities, regardless of sector, can deliver improved fleet management, monitoring, contactless-delivery technology, increased productivity, and lower TCO, while keeping critical data and crew safe. Scale Computing HC3 is highly available, keeping critical applications and data always on and available, and provides the simplicity and scalability needed to meet the IT infrastructure demands of transportation.

Boughey Distribution Ltd was searching for the right solution to replace aging hardware and execute an infrastructure refresh. By selecting HC3, Boughey Distribution was able to decrease the time spent recovering from a hardware failure running a critical workload from 1-8 hours to less than 10 minutes, an 83-percent to 97-percent reduction in recovery time.

“Having a single point of contact is huge as most issues can and have been resolved with a 10 minute phone call. With my last providers I had to play phone tennis where one would pass me to the other. Cost is another bonus because the combined total was cheaper than the upgrade to another VMware and server provider,” said Paul Brough, Network Administrator, Boughey Distribution Ltd.

Challenger Motor Freight, Inc. was searching for the right solution to replace aging hardware and execute an infrastructure refresh to support growth and new business initiatives. By selecting HC3, Challenger was able to decrease the time spent recovering from a hardware failure running a critical workload from 1-8 hours to less than 10 minutes, an 83-percent to 97-percent reduction in recovery time.

“We are now able to just use the system. We can deploy VMs in seconds, which makes test/dev so much easier. High availability and replication come out of the box. We do not have to worry about patches for switch, san, server, and hypervisor. When needed, Scale Computing support is the best support I have received from any vendor ever in my 25 years of experience,” noted Scott Benninger, IT Manager, Challenger Motor Freight, Inc.

As the mass transit agency that provides bus transportation within State College, Pennsylvania, and the surrounding areas, as well as Pennsylvania State University, Centre Area Transportation Authority (CATA) requires highly-available IT infrastructure to deliver uninterrupted service to its customers. By implementing HC3, CATA was able to improve its disaster recovery, reduced its IT complexity with a single vendor to support its infrastructure, and reduced IT operating costs.

Donny Lynch, IT specialist at Centre Area Transportation Authority, states, “Scale Computing HC3 handles our server needs across the organization for our ERP systems, SQL servers, and remote access. Their technology has been critical in consolidating older legacy server hardware and server OS into one easy-to-manage-and-monitor system.”

Empire Airlines in Hayden, Idaho, flies 50 aircraft for FedEx, as well as passenger and cargo aircraft for Hawaiian Airlines. In addition to its air carriers, Empire Airlines has a maintenance repair overhaul facility in Idaho.

According to Melanie Ellingson, director of IT at Empire Airlines, the company was looking to upgrade its legacy IT infrastructure with a virtualization solution. Ease of use was a priority for Ellingson, who said she wanted a simple solution that did not require additional training or specialized personnel to maintain the IT infrastructure. After researching competitors, Ellingson selected Scale Computing, stating, “With Scale Computing, you plug it in, turn it on, and you’re running. That’s all there is to it.”

Scale Computing is currently offering transportation organizations a free trial for Scale Computing HC3 Edge. Learn more.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Scale Computing 
Scale Computing is a leader in edge computing, virtualization, and hyperconverged solutions. Scale Computing HC3 software eliminates the need for traditional virtualization software, disaster recovery software, servers, and shared storage, replacing these with a fully integrated, highly available system for running applications. Using patented HyperCore™ technology, the HC3 self-healing platform automatically identifies, mitigates, and corrects infrastructure problems in real-time, enabling applications to achieve maximum uptime. When ease-of-use, high availability, and TCO matter, Scale Computing HC3 is the ideal infrastructure platform. Read what our customers have to say on Gartner Peer Insights, Spiceworks, TechValidate and TrustRadius.

×

Hello!

Click one of our contacts below to chat on WhatsApp

Social Chat is free, download and try it now here!

×