Blog Articles

What's new this week in the news for MSPs?

Nutanix introduces new services to help pandemic-affected companies; AWS launches Amazon Honeycode; Maze ransomware allegedly strikes LG Electronics; newcomer WastedLocker ransomware leveraging fake program updates; and CLOP Ransomware hits Indiabulls group. Let's see what it's all about.

Continue reading

Before we talk about Azure PowerShell vs Azure CLI, first of all, we need a bit of background. Both are available in the Azure cloud or you can use them remotely from your workstation. On your workstation, you will have to install a module, which we will explain later, but both are available in Azure Cloud Shell. Azure CLI is short for the Azure command-line interface. Continue reading

What's new this week in the news for MSPs?

Google launches a new cloud file storage tier; AWS adds a new data migration device; AWS solves a 2.3 Tbps DDOS attack; fake data breach notification malware caught by Google; and Black Kingdom ransomware hack manipulating Pulse VPN flaws.
Let's see what it's all about.

Google Launches a New Cloud File Storage Tier

Google has announced the launch of its new product Filestore High Scale, a cloud-based file storage tier for businesses operating high-performance computing workloads. It is said to be the next step in the development of Google's Cloud Filestore service.

With Filestore High Scale, Google has integrated the capabilities of data storage startup Elastifile Ltd., which it acquired in July 2019. The new tier lets users send shared file systems that can expand to a capacity that permits hundreds of thousands of input/output operations per second, with tens of gigabytes per second throughput and hundreds of terabytes.

Google said that other workloads that may benefit from Filestore High Scale's scale-out storage are electronic design automation, financial modeling, genomics, and video processing.

AWS Adds a New Data Migration Device

AWS Snowcone is a new device added by Amazon to its family of data migration devices. This device is small and very portable, weighing only 4.5 pounds and measuring just nine by six by three inches. It provides up to 8 terabytes of storage for businesses using edge computing workloads, where space, power, and cooling features are limited.

AWS Snowcone operates on two central processing units. It has 4 gigabytes of memory for computing operations, a USB-C connection, and an optional battery unit.

In a blog post, Amazon Chief Evangelist Jeff Barr shared that Snowcone's primary objective is data migration, “Internet of Things,” transportation, content distribution and tactical edge computing, logistics, and autonomous vehicles use cases. What's more, the device is tamper-proof, dust-tight, water-resistant, and can transfer data using the AWS DataSync service.

AWS Snowcone will be available first in the AWS East (Northern Virginia) and AWS West (Oregon) regions, and additional regions will be added soon.

AWS Minimizes a 2.3 Tbps DDOS Attack

Amazon Web Service reported that it was able to diminish a distributed denial-of-service attack of 2.3 terabits per second in February. It is the most massive DDoS attack on record to date. According to the details given in the AWS Shield Threat Landscape Report- Q1 2020, this attack continued for three days. Those behind the attack failed to knock Amazon cloud services offline.

The method used is the so-called Connection-less Lightweight Directory Access Protocol reflection-based attack. In this type of attack, the attacker sends a CLDAP request to an LDAP server with a spoofed sender IP address — the target's IP address. The server then mounts a bulked-up response to the target's IP address, causing the reflection attack, hence the name.

The server is unaware of the attack when it receives multiple, apparently legitimate requests to establish communication, according to Imperva. From each open port, it answers each attempt with an SYN-ACK packet. This will eventually cause the server's connection overflow tables to flood and genuine clients will be denied access.

Fake Data Breach Notification Malware Caught by Google

To distribute malware and scams, bad actors have begun pushing fake notices about data breaches at big company names. These direct people to risky websites. The groups behind them are mixing Google Sites, black SEO, and spam pages.

 

Google Alerts, which uses predefined terms set by users to monitor search results, has helped in the spread of these false notifications. Some companies found in the notifications include Dropbox, Hulu, Ceridian, Shein, PayPal, Target, Chegg, EA, Canva, HauteLook, Mojang, InterContinental Hotels Group, and Houzz. These companies have suffered a data breach at some point in the past.

If a user follows any of these links picked up by Google Alerts, they find themselves on landing on pages with download offers for undesired extensions and malware, and fake giveaways.

Aside from using compromised websites, these groups also make their own pages. In many instances, they have used Google Sites to host their content.

A fake giveaway of iPhone 11 devices was one of the malicious links used as a redirect, claiming to have been set up by Google for its “Membership Rewards” program.

Using spam pages to redirect users to pages that pose a risk is not new; this is just the latest example by a malware group.

ON-DEMAND WEBINAR

Ransomware: Prevent or Recover

Watch the webinar and prepare yourself and your customers with the right approach and the right tools

Black Kingdom Ransomware Hack Manipulating Pulse VPN Flaws

Businesses with unpatched Pulse Secure VPN software or initial access on the network are the target of the operators of the Black Kingdom ransomware. The malware was captured in a honeypot computer system that let security researchers examine and document its methods of operation.
A Pulse Secure VPN (CVE-2019-11510) critical vulnerability affecting earlier versions of its software was leveraged by the malware operators.

Researchers noted that the ransomware built endurance by mimicking a legitimate scheduled task for Google Chrome. According to REDTEAM.PL's analysis, it's likely that a scheduled task runs base64-encoded string code in a hidden PowerShell window to get a script named “reverse.ps1”, and then opens a reverse shell on the infected host.

Security researcher GrujaRS first spotted Black Kingdom ransomware in February, when it appeared to have appended a .DEMON extension to encrypted files.

The sample examined communicated with the same IP address seen in REDTEAM.PL's report. The ransom note sought $10,000, to be deposited to a bitcoin wallet, and threatened that failure to do so would lead to the data being destroyed or sold.

Learn about common ransomware attack scenarios and what to do if one of these attacks affects your clients:

Further reading Ransomware Attack Scenarios

That's a Wrap

I hope this update has been helpful. MSP360 is your resource for MSP news. Stay home, stay safe and healthy, and remember to check back next week for more highlights.

In the mid-1970s, when I was working in the Navy’s new cybersecurity group, we had it easy.

Not that we felt like that, of course. Automation was still pretty primitive, and encrypting messages often took hours (if not days). But looking back, we had one huge advantage over the cybersecurity engineers of today: we didn't let anyone touch our equipment. Everyone had to go through us to send messages and protect data, and so we could make sure that this was done correctly. Continue reading

Cloud is becoming so cheap, reliable, and safe that more and more companies are moving workloads there. Anything from database management to IoT, from data storage and backup to email exchange servers, can nowadays be run in the cloud in a scalable and cost-efficient manner. In fact, you can build a company solely upon the infrastructure of one of the cloud giants: Amazon Web Services, Microsoft Azure, or Google Cloud. And, in fact, many companies do this.

Continue reading