TheEncryption Software Marketresearch report presents a comprehensive assessment of the market and contains thoughtful insights, facts, historical data and statistically-supported and industry-validated market data and projections with a suitable set of assumptions and methodology. It provides analysis and information by categories such as market segments, regions, and product type and distribution channels.

The report begins with a brief introduction and market overview, in which the Encryption Software industry is first defined before estimating its market scope and size. Next, the report elaborates on the market scope and market size estimation. This is followed by an overview of the market segmentations such as type, application, and region. The drivers, limitations, and opportunities are listed for the Encryption Software industry, followed by industry news and policies.

Our analysis involves the study of the market taking into consideration the impact of the COVID-19 pandemic. Please get in touch with us to get your hands on an exhaustive coverage of the impact of the current situation on the market. Our expert team of analysts will provide as per report customized to your requirement.

Get Sample Copy of this Report @https://www.bigmarketresearch.com/request-sample/3871377?utm_source=GEETA-PFN

Top Key Players involved in Encryption Software Industry are:Microsoft Corporation (U.S.)Sophos Ltd. (U.S.)CheckPoint Software Technologies Ltd. (Israel).Trend Micro Inc. (Japan)Symantec Corporation (U.S.)IBM Corporation (U.S.)SAS Institute Inc. (U.S.)Intel Security Group (McAfee) (U.S.)EMC Corporation (U.S.)WinMagic Inc. (Canada)

Regions & Top Countries Data Covered in this Report are:Asia-Pacific (China, Southeast Asia, India, Japan, Korea, Western Asia), Europe (Germany, UK, France, Italy, Russia, Spain, Netherlands, Turkey, Switzerland), North America (United States, Canada, Mexico), Middle East & Africa (GCC, North Africa, South Africa) , South America (Brazil, Argentina, Columbia, Chile, Peru).

The report includes an analysis of the growth rate of every segment with the help of charts and tables. In addition, the market across various regions is analyzed in the report, including North America, Europe, Asia-Pacific, and LAMEA. The report manifests the growth trends and future opportunities in every region.

Global Encryption Software market is presented to the readers as a holistic snapshot of the competitive landscape within the given forecast period. It presents a comparative detailed analysis of the all regional and player segments, offering readers a better knowledge of where areas in which they can place their existing resources and gauging the priority of a particular region in order to boost their standing in the global market.

The Global Encryption Software Market is gaining pace and businesses have started understanding the benefits of analytics in the present day highly dynamic business environment. The market has witnessed several important developments over the past few years, with mounting volumes of business data and the shift from traditional data analysis platforms to self-service business analytics being some of the most prominent ones.

By Type:CloudOn-Premises

By Application:Financial SectorHealthcarePublic Sector

The Global Encryption Software Market is gaining pace and businesses have started understanding the benefits of analytics in the present day highly dynamic business environment. The market has witnessed several important developments over the past few years, with mounting volumes of business data and the shift from traditional data analysis platforms to self-service business analytics being some of the most prominent ones.

For the future period, sound forecasts on market value and volume are offered for each type and application. In the same period, the report also provides a detailed analysis of market value and consumption for each region. These insights are helpful in devising strategies for the future and take necessary steps. New project investment feasibility analysis and SWOT analysis are offered along with insights on industry barriers. Research findings and conclusions are mentioned at the end.

Reasons for Buying This Report:

Get Discount on This Report @https://www.bigmarketresearch.com/request-for-discount/3871377?utm_source=GEETA-PFN

About Us:

Big Market Research has a range of research reports from various publishers across the world. Our database of reports of various market categories and sub-categories would help to find the exact report you may be looking for.

We are instrumental in providing quantitative and qualitative insights on your area of interest by bringing reports from various publishers at one place to save your time and money. A lot of organizations across the world are gaining profits and great benefits from information gained through reports sourced by us.

Contact us:

Mr. Abhishek Paliwal

5933 NE Win Sivers Drive, #205, Portland,

OR 97220 United States

Direct: +1-971-202-1575

Toll Free: +1-800-910-6452

E-mail:[emailprotected]

Go here to read the rest:
Encryption Software Market Report to Share Key Aspects of the Industry with the Details of Influence Factors- 2024 - Owned

Apricorn has released its new Aegis Secure Key 3NXC drive that features robust security, a rugged chassis, and a USB Type-C connector.

The ApricornAegis Secure Key 3NXCdrive, which is fast enough to run an operating system, features its own AES-XTS 256-bit encryption chip as well as a keypad to enter numerical PINs. At present, the storage device isFIPS 140-2 level 3 validation pending and the company expects to get it in Q3 2020.

The USB-C Aegis Secure Key 3NXC drive supports read-only mode for those who need to carry sensitive data and do not need to alter it anyhow as well as a read-write mode for those who may need to change the data on the drive or boot an operating system from it. Since encryption is hardware-based, it is seamless for OS and therefore the Aegis Secure Key 3NXC devices are compatible with virtually all operating systems available today, including Apples MacOS, Googles Android, Microsofts Windows, and even Symbian.

The firmware of the drive is locked down and cannot be altered by malware or exploits (e.g., BadUSB), which means that thedriveitself is secure. Furthermore, the drive has its own battery that charges when it is plugged to a host, so an unlock pin can be entered while the drive is not plugged.

The Aegis Secure Key 3NXC drive comes in an aluminum chassis and is IP68-rated against water and dust. It also comes in an enclosure for extra protection. Measuring 81mm x 18.4mm x 9.5mm, the device weighs 22 grams.

Apricorn, which specializes in hardware-encrypted storage devices, offers multiple versions of its Aegis Secure Key 3NXC drives featuring capacities ranging from 4GB to 128GB. The company does not disclose performance of the storage device and only mentions a 5Gbps theoretical throughput of a USB 3.2 Gen 1 interface, but higher-end Aegis Secure Key 3NXC are probably fast enough to boot an operating system in a reasonable amount of time.

There is one caveat with using Apricorns Aegis Secure Key 3NXC drive as a boot drive. Microsoft recentlycanned Windows To Goin Windows 10 Enterprise and Windows 10 Education (version 2004 and later) that enabled the creation of a Windows To Go workspace that could be booted from a USB drive. To that end, those who would like to use an Aegis Secure Key 3NXC to boot an OS will have to use an outdated version of Windows, or go with a Linux OS.

Apricorns Aegis Secure Key 3NXC drive are available directly from the company. A 4GB model costs $59 or 52.45, whereas a 128GB is priced at $179 or 159.13 depending where are you at. Considering the fact that the devices are aimed at various government and corporate personnel who have access to sensitive data as well as hardware encryption, metallic chassis, and other sophisticated features, prices of these drives look justified.

Source:Apricorn

Go here to see the original:
This hardware-encrypted USB-C drive is rugged, inexpensive, and can run Windows - TechRadar UK

Virtual machines have long been heralded as a tool for avoiding malware and ransomware infections. Many security-conscious IT pros, for example, do all of their casual Web browsing from within a virtual machine. The idea is that if a malware infection were to occur, then the virtual machine could easily be reset to a pristine state while the parent operating system remained completely isolated from the infection. Recently, however, ransomware authors have begun using virtual machines as an attack mechanism and Windows administration tools as a way to evade detection.

Perhaps the best example of this is an attack conducted by the Ragnar Locker Group, which has been involved in some high-profile extortion schemes in the past. One of the widely publicized examples was when the group attacked Energias de Portugal. In that particular attack, the group claimed to have stolen 10 TB of data and threatened to release the data to the public unless the company paid a ransom of 1,580 bitcoin (which was about 11 million U.S. dollars). More recently, business travel management company CWT Global B.V. paid a ransom demand following a ransomware attack that reportedly involved Ragnar Locker.

The Ragnar Locker Group is now using virtual machines as a tool for helping its ransomware to evade detection. The attack begins by compromising a Windows machine in an effort to gain administrative access. This is commonly done by exploiting an insecure (and externally accessible) RDP connector. Once the group has gained administrative access, the next step in the attack is to modify a Group Policy Object.

Windows administrators commonly use Group Policy settings as a tool for pushing legitimate software applications to network endpoints. If you look at the figure below, for example, you can see that the Group Policy Management Editor provides a Software Installation option beneath the User Configuration Policies Software Installation node. Ragnar Locker exploits this particular Group Policy setting as a tool for distributing its ransomware. However, this process isnt quite as simple as merely packaging malware and using Group Policy settings as a distribution tool. If that was all that was required, then the malicious software would almost certainly be detected by antivirus software.

One of the ways Ragnar Locker avoids detection is through the use of native Windows administrative tools. Because these tools are a part of the Windows operating system, their use is somewhat unlikely to be immediately determined to be malicious. While victims will no doubt eventually figure out that their networks have been compromised, the use of a native administrative tool typically isnt going to raise an immediate alarm like the detection of malware would.

The Group Policy setting instructs Windows to run Microsoft Installer (MSIExec.exe). It passes parameters to the installer that cause it to silently download a malicious MSI package from the internet. This package includes, among other things, a copy of Oracles VirtualBox hypervisor and a lightweight virtual machine image. Some support scripts that are included in the MSI package disable various Windows security features and install VirtualBox along with the malicious virtual machine. They also delete volume shadow copies, thereby preventing the user from restoring previous (unencrypted) versions of the files without the aid of a dedicated backup application.

Once everything is in place, the virtual machine goes to work encrypting everything that it can. It attacks both local storage and network storage. It even goes so far as to terminate any applications that the user is currently working in so that the files become unlocked and can therefore be encrypted.

Because the ransomware is running within a virtual machine, its presence is likely to evade detection. The Windows operating system sees all of the encryption activity as being related to a virtual machine, rather than being able to see the malicious process that is running inside of the virtual machine. Sophos provides a detailed analysis of how the Ragnar Locker exploit works.

The good news is that the Ragnar Locker attacks are highly targeted. You arent going to fall victim to this attack by accidentally opening a malicious email attachment. After all, the attack can only succeed if the attacker is able to first establish administrative access to the target system.

Even so, I expect to see copycats perform similar, more random attacks in the future. Since so many people log into their PCs with administrative credentials, there is nothing stopping ransomware from exploiting a users existing credentials and performing a similar attack. As such, organizations should consider using AppLocker or a third-party tool to prevent the installation of unauthorized software.

See the article here:
Windows Administration Tools and VMs Open Windows to Ransomware - ITPro Today

Table of Contents

Introduction

A History Of Terrorist Bots On Twitter

The MEMRI JTTM Team: For Over Two Years, Monitoring Bots Spreading ISIS Content On Telegram

Creating Bots On Telegram

Jihadi Use Of Bots On The Encrypted Messaging Platform Telegram

Swearing Allegiance To ISIS

Discussing And Sharing Instructions For Online Security, Secure Communications, And Hacking

Sharing Information About Jihadi Channels, Archives, And Materials

Disseminating Warnings To Followers

Other Uses

Fundraising

Announcements Of New Bots And Requests For Distribution

Sharing Information About Jihadi Channels, Archives, And Materials

Sharing Information About Jihadi Channels, Archives, And Materials

Sharing Information On Training, Bombmaking, Weapons, And Recruiting

Introduction

Bots, or chatbots short for "chat robot" are computer programs that simulate human conversation "chat" through artificial intelligence.[1] They are typically created to carry out repetitive, pre-defined tasks more efficiently than humans.[2] They can be used for ecommerce, customer service, and content distribution; one common type, the chatbot, simulates conversation, while other types can schedule social media or other posts or create polls. Platforms such as Facebook Messenger,[3] Twitter,[4] and WhatsApp[5] offer bot integration. Botnets are connected computers performing monotonous tasks to keep websites going.[6] They are also becoming companions for people: In April 2020, half a million people downloaded an app called Replika that allows the user to converse with a human-like robot over text. While that app is not entirely convincing, some experts believe a completely convincing chatbot will exist in five to 10 years.[7]

Bot technology is also used for illegal purposes for example, sending spam and phishing emails containing malware, engaging in internet fraud, and trafficking in illegal goods and services. Illegal botnets gain control of computers through hacking or malicious coding and their owners can then use these computers to carry out DDoS attacks, email spam to many more millions of Internet users, generate fake Internet traffic, and extort ransom from users.[8]

To keep pace with China's ambitious artificial intelligence development, on February 11, 2019,[9] President Trump signed an executive order announcing the American Artificial Intelligence Initiative.[10] This strategy, according to the White House, is a concerted effort to promote and protect national AI technology and innovation, that "implements a whole-of-government strategy in collaboration and engagement with the private sector, academia, the public, and like-minded international partners." The move followed calls from AI experts[11] across industry, academia, and government to prioritize development of this area, including a May 2018 memo from then-defense secretary James Mattis asking the president to create a national strategy for AI. At the same time, however, there has so far been little research into how terrorist groups are already utilizing some of the basic forms of AI available to them, such as bots.

A History Of Terrorist Bots On Twitter

Every day, bots are being used by jihadis, especially on Telegram, for a wide variety of purposes. Highlighting these uses just recently was the pro-Al-Qaeda Jaysh Al-Malahim Al-Electroni Telegram channel that announced, on July 20, 2020, that it was recruiting supporters with expertise in programming, "media raids," film montage, hacking, translation, and graphic design. Those interested, it added, should make contact using its bots.[12] The same day, the pro-ISIS Basa'ir Da'wah Foundation, on Telegram, urged supporters, especially designers, poets, and religious students, to join the foundation's team by contacting its bot on the platform.[13]

Jaysh Al-Malahim recruitment notice; Basa'ir Da'wah Foundation recruitment notice

Also, on July 23, the pro-Al-Qaeda Jaysh Al-Malahim Al-Electroni announced that it was seeking a commentator with excellent Arabic for its videos and asked candidates to apply to its Telegram bot.[14]

The recruitment notice referring candidates to Jaysh Al-Malahim Al-Electroni's Telegram bot

A pro-ISIS Telegram bot warned, on August 3, that intelligence and "Rafidites" Shi'ites had infiltrated pro-ISIS groups on Telegram and were creating fake accounts under the names of genuine ISIS supporters. It named three specific Telegram accounts claiming to be pro-ISIS that it said were actually run by Shi'ites.[15]

Underlining how bots are energizing jihadis' daily social media efforts, on August 5, Jaysh Al-Malahem Al-Electroni released a poster titled "We Remain in the Media Battle, Victorious." It depicts an armed fighter with the logos of Telegram, Instagram, Facebook, Pinterest, LinkedIn, YouTube, and Twitter.[16]

As early as 2015, when it was estimated that bots made up over half of all Internet traffic, ISIS was already known to have created thousands of Twitter bots to disseminate violent content, raise funds, and recruit supporters, as well as jamming activist communication on the platform, silencing their opponents on Twitter.[17] The bots latched onto trending hashtags to send out a stream of pro-ISIS messages a tactic adopted by ISIS as early as 2014[18] with the aim of inserting ISIS into ongoing conversations on different topics. Following the November 2015 Paris ISIS attacks, the international hacktivist group Anonymous launched a campaign against ISIS bots across the Internet under the hashtag #opISIS, shutting down over 25,000 of them within a month.[19]

After ISIS leader Abu Bakr Al-Baghdadi was killed by U.S. forces in late October 2019, Mustafa Ayad, a terrorism researcher at the London-based Institute for Strategic Dialogue, noticed on Twitter that many ISIS tweets were being posted faster than humanly possible. Accounts posting them that were suspended quickly returned with slight changes in usernames to avoid detection, while other accounts posting the content appeared to have been hacked. Twitter said that between January and July 2019 it had suspended more than 115,000 accounts for terrorism-related violations.[20] Telegram CEO Pavel Durov has stated that he takes steps to remove jihadi accounts and content on the platform, and has on occasion taken limited action to do so, but the accounts generally return.

A May 20 virtual forum held by the House Homeland Security Committee tackled the question of whether the coronavirus pandemic is fueling extremism on social media. Session co-host Rep. Max Rose, chairman of the Intelligence and Counterterrorism Subcommittee, said: "Terrorists' use of the Internet has been magnified by this public health crisis, with social media and gaming platforms increasingly being used for recruitment and propaganda here and around the world particularly as people spend more and more time online at home."[21] Bots are one technology that makes spreading that misinformation and messaging easier for extremist groups.

The MEMRI JTTM Team: For Over Two Years, Monitoring Bots Spreading ISIS Content On Telegram

As part of the work of the Cyber Jihad Lab team, which studies terrorists' use of technology, and of the MEMRI Jihad and Terrorism Threat Monitor (JTTM) team, over the past two years both teams have documented and identified the accounts in this report on the encrypted messaging app Telegram that are using bots. In October 2019, Telegram's @ISISWatch channel claimed to have blocked 7,431 terrorist bots and channels, many of which were used to launch campaigns for fundraising using cryptocurrency.[22] @ISISWatch was created the day after MEMRI exposed Telegram as ISIS's and jihadis' "app of choice" in a report published December 23, 2016 a report that made the front page of The Washington Post.[23] At that time, ISISWatch stated that Telegram "actively bans ISIS content on Telegram," that it was shutting down "an average of 70 ISIS channels" each day, and that between September and December 2016 it had shut down nearly 8,000 "ISIS bots and channels."[24] Nevertheless, Telegram remains a haven for jihadi communications, outreach, recruiting, and other activity even though the ISISWatch channel continues to report daily on terrorist bot and channels it claims to have removed.

Creating Bots On Telegram

Telegram allows users to create bots for sending, responding to, and otherwise managing messages, news, and notifications. They can also be used to manage digital assets such as cryptocurrencies.[25] Telegram's @BotFather tool walks users through the process quickly and easily, and provides support for questions connected to the process.[26]

To create a bot, the user first searches for @BotFather on Telegram, and then clicks on it to begin the process:

The user is then asked to create a name and username for the new bot. Once this is done, Telegram generates a unique link to the bot where the user can add a description, about section, and profile picture, and directs the user to a list of commands that it can be programmed to carry out.

To view a video of the creation of a Telegram bot, click here or below:

JIHADI USE OF BOTS ON THE ENCRYPTED MESSAGING PLATFORM TELEGRAM

Telegram's popularity among jihadis over the past five years has been well documented; for example, since 2015,[27] the Islamic State (ISIS) has used it in an official capacity, to disseminate calls for violence and share detailed instructions on how to carry out terrorist attacks, and to coordinate attacks an early example being the 2015 Paris attacks.[28]

ISIS, Al-Qaeda, and other jihadi organizations as well as their supporters are using bots on Telegram to disseminate their messaging in a variety of languages. They can be created in a chat or channel to allow them to connect with users. The bots can handle messages, with group members conversing with the bot as with a human. The MEMRI JTTM has been monitoring jihadi bots on Telegram since 2015.[29]

The examples below show how jihadi organizations ISIS, Al-Qaeda, Hay'at Tahrir Al-Sham (HTS), the Somali Al-Qaeda affiliate Al-Shabab Al-Mujahideen, the Gaza-based Jaysh Al-Ummah, and Kashmiri jihadi groups and their supporters, and other jihadis, are using bots on Telegram for a wide range of purposes.

While one major use is for mass dissemination of official notifications, publications, and video productions, these groups also use bots designed to allow users to access archives of jihadi content produced by groups and media organizations. The archives were found to include content from Turkestan Islamic Party (TIP), Voice of Islam, Al-Qaeda in the Arabian Peninsula's (AQAP) Al-Malahem Foundation, Libyan Al-Rayah Foundation, Al-Shabab's Al-Kata'ib Foundation, Al-Qaeda In The Islamic Maghreb's (AQIM) Al-Andalus Foundation, Al-Qaeda media group Global Islamic Media Front (GIMF), Group for the Support of Islam and Muslims (GSIM) Al-Zalaqah Foundation, and Jabhat Al-Nusra's (JN) Al-Manarah Al-Bayda' Foundation.

Also found in the archives was content from jihadi factions in Syria, Iraq, Chechnya, Bosnia, Egypt, Tunisia, and Libya, and from jihadi leaders past and present, including Osama bin Laden, Al-Qaeda leader Ayman Al-Zawahiri, HTS leader Abu Muhammad Al-Joulani, and Syria-based cleric Abdullah Al-Muhaysini.

Bots used by jihadis also allow users to request information and publications and register for courses, for example for physical fitness and bombmaking; solicit documents for later publication; submit and answer questions about migrating to Syria or Iraq, about technology, and about other subjects; widely share links to new Telegram channels following shutdowns; share tutorials on cyber security; use and hack accounts on social media platforms; recruit volunteer translators, video editors, and others; request donations for poor families, including families of slain jihadis; announce new accounts in multiple languages; promote causes such as supporting or freeing women from Al-Hol camp in Syria; and even convey holiday wishes.

This report documents the past two years of the JTTM's monitoring of jihadi use of bots for recruiting, fundraising, plan hacking and terror attacks, and more. It includes their use by major terrorist groups ISIS, Al-Qaeda, and others and by the most influential hacking groups and cyber activists. This use of bots a sophisticated tool made readily available to the public of social media users is a sign of what is to come: Jihadi groups will be using them much more in the future, and the West needs to be prepared to stop this before it happens.

ISLAMIC STATE (ISIS)

Planning Attacks, Sharing Information On Training, Bombmaking, And Weapons, Disseminating News, And Recruiting

The pro-ISIS Nasr News launched a new Telegram bot distributing official ISIS news in the Indonesian language: @NN20id_bot.[30]

On March 18, 2020, pro-ISIS Al-Tamkin Box launched a new Telegram bot, @Nooooooooods_bot, which distributes official ISIS news reports, official and unofficial videos, the Al-Naba' weekly, and articles by Al-Tamkin.[31]

JTTM subscribers can click here to view the full report

*Steven Stalinsky is Executive Director of MEMRI; R. Sosnow is Head Editor at MEMRI.

[1] Voxprogroup.com/iot-and-ai/ai-machine-learning-and-bots-whats-it-all-about, May 2017.

[2] Cdn2.hubspot.net/hubfs/53/assets/hubspot.com/research/reports/What_is_a_bot_HubSpot_Research.pdf?t=1492209311951, accessed July 30, 2019.

[3] Blog.hootsuite.com/facebook-messenger-bots-guide, May 9, 2019.

[4] Chatbotslife.com/how-to-make-a-twitter-bot-841b20655328, January 9, 2018.

[5] chatbotsmagazine.com/a-step-by-step-guide-to-creating-whatsapp-chatbot-for-business-275dc3924b17, May 14, 2019.

[6] Us.norton.com/internetsecurity-malware-what-is-a-botnet.html.

[7] Nytimes.com/2020/06/16/technology/chatbots-quarantine-coronavirus.html, July 16, 2020.

[8] Us.norton.com/internetsecurity-malware-what-is-a-botnet.html.

[9] Nbcnews.com/tech/tech-news/trump-s-artificial-intelligence-order-lacks-funding-not-target-china-n970406, February 11, 2019.

[10] Whitehouse.gov/ai/executive-order-ai/.

[11] Nytimes.com/2018/08/26/technology/pentagon-artificial-intelligence.html, August 26, 2018.

[13] Telegram/ Ghiras11bot, July 20, 2020.

[14] Talk.gnews.bz/channel/news-akhbar?msg=2yweGevZj58h2gpci, July 23, 2020.

[15] Telegram/ UI_BXH_X_BOT, August 3, 2020

[16] Telegram/ Al_MalahemCyberArmybot, August 5, 2020.

[17] Imperva.com/blog/bot-traffic-report-2014/, December 18, 2014.

[19] Businessinsider.com/anonymous-battles-isis-political-bots-2015-12, December 14, 2015.

[20] Npr.org/2019/11/01/775509366/twitter-struggling-to-shut-down-bot-and-impersonation-accounts-created-by-isis, November 1, 2019.

[21] Homelandprepnews.com/stories/49829-social-media-companies-must-use-ai-to-thwart-extremist-content-experts-tell-congressmen, May 27, 2020.

[22] Decrypt.co/11229/us-and-australian-officials-concerned-over-terrorist-cryptocurrency-use,November 7, 2019.

[25] Core.telegram.org/bots, accessed July 30, 2019; Coinrivet.com/what-is-a-cryptocurrency-telegram-bot, June 20, 2019.

[26] Core.telegram.org/bots/api, accessed July 30, 2019.

[28] See MEMRI report Germany-Based Encrypted Messaging App Telegram Emerges As Jihadis' Preferred Communications Platform Part V Of MEMRI Series: Encryption Technology Embraced By ISIS, Al-Qaeda, Other Jihadis September 2015-September 2016, December 23, 2016; MEMRI Daily Brief No. 192, Fears About New Facebook Cryptocurrency Are Overblown While Main Threat Of Criminal Activity On Telegram App Is Being Criminally Ignored, July 16, 2019; MEMRI Daily Brief No. 161, As Momentum Builds To Solve Problem Of Encrypted Terrorist Communications, A Possible Third Way Emerges, May 24, 2019; MEMRI Daily Brief No. 174, The Cryptocurrency-Terrorism Connection Is Too Big To Ignore, January 3, 2019; MEMRI Inquiry and Analysis No. 1387, The Imminent Release Of Telegram's Cryptocurrency, ISIS's Encryption App Of Choice An International Security Catastrophe In The Making, March 30, 2018; Congressional letter to Telegram CEO Durov, Memri.org/pdf/20181025_Telegram_sherman-Poe.pdf.

[29] Rsis.edu.sg/rsis-publication/cens/co15256-telegram-and-is-a-potential-security-threat/#.XUCPdOhKiUk, November 25, 2015.

[31] Telegram/ Ma Lakum Kayfa Tahkumun, March 18, 2020.

Originally posted here:
Jihadi Use Of Bots On The Encrypted Messaging Platform Telegram - Middle East Media Research Institute

A companion bill to an anti-encryption bill that has been called dangerous by privacy advocates was introduced in the House of Representatives on Thursday.

Rep. Ann Wagner (R-Mo.) introduced the House version of the Lawful Access to Encrypted Data Act on Thursday. A Senate version of the bill was introduced in late June by Sen. Lindsey Graham (R-S.C.), Sen. Tom Cotton (R-Ark.), and Sen. Marsha Blackburn (R-Tenn.).

The bill purports to want to stop warrant-proof encryption to help law enforcement access encrypted data. It would specifically require device manufacturers and service providers to assist law enforcement with accessing encrypted data if assistance would aid in the execution of the warrant, according to a background of the bill.

Almost immediately, the Senate version of the bill faced intense backlash from privacy and civil liberties advocates and marked another notch in the encryption battle that has gone on for years.

Like the Senate version, Wagners House companion bill garnered the enthusiastic backing of Attorney General William Barr, who has long argued for law enforcement to have a back door into encryption.

Numerous advocates have called out the Lawful Access to Encrypted Data Act as misguided, and dangerous. Critics of the bill argue that creating a back door into encryption for law enforcement opens the door for bad actors to similarly find a way in.

The Lawful Access to Encrypted Data Act isnt the only bill in Congress drawing scorn from encryption advocates.

The EARN IT Act, a bill that was amended and passed through a Senate committee earlier this month, has been criticized as a potential threat to encryption. Lawmakers on both sides of the aisle have asserted that the bill aims to curb child exploration online.

The bill would now subject tech companies to a host of state-level laws and potential lawsuits if they use encryption, advocates have warned. Nearly 600,000 people have signed a petition calling on members of Congress to reject it.

READ MORE:

*First Published: Jul 31, 2020, 8:52 am

Andrew Wyrich is the deputy tech editor at the Daily Dot. Andrew has written for USA Today, NorthJersey.com, and other newspapers and websites. His work has been recognized by the Society of the Silurians, Investigative Reporters & Editors (IRE), and the Society of Professional Journalists (SPJ).

Read this article:
Both chambers of Congress now have a version of a dangerous anti-encryption bill - The Daily Dot

This year has been a bumper year for ransomware and its operators. Ransomware gangs are demanding millions; if those millions are not paid in time, then data stolen before encryption is either released to the public or sold to the highest bidder. Big names in the cybercriminal underground have returned with an entirely new ransomware familynamely Evil Corp and its new creation WastedLocker. Not only is there a return to form for old hands, but new ransomware strains also seem to be bursting up like mushrooms after a spell of rain. NetWalker and Exorcist immediately come to mind. The latter is the subject of this article.

Discovered in late July by MalwareHunterTeam, the Exorcist ransomware is so new to the scene that information on it had been incredibly sparse. That was until Leandro Velasco published an article shedding much of the codes mysteryand in great depth. The article is a must-read for anybody wanting a technical analysis of the ransomware. In providing a brief overview of Exorcist, it seems to be distributed via a Pastebin PowerShell script that runs in memory. The script takes from lessons learned by Sodinokibi affiliates and is based on the Invoke-ReflectivePEInjection.ps1 script, further optimized to include a function that passes a base64 executable into the main function of the script. It is also possible that the script is generated by the no-longer-supported Empire framework.

The code itself is not obfuscatedwhile common practice with other types of malware, it is often not deemed necessary for ransomware by its developers. Part of the reason for this is that the encryption process is in itself very noisy and once that begins, any pretense of stealth is quickly forgotten and speed is the main requirement. Some ransomware strains do obfuscate their code, but it is not an unwritten rule that all malware be obfuscated.

The malwares first operation is to check the geolocation of the infected machine, which is done by checking the language and keyboard layout of the machine in question. If the result is any of the nations that make up the Commonwealth of Independent States (CIS)which includes many of the nations that made up the Eastern Block during the Cold War and now still have close ties to Russiathe malwares operations are immediately stopped. Why this is done is discussed in greater depth in the second part of this article.

Screenshot of a ransom demanding message displayed by Exorcist ransomware:

If the geolocation check returns a nation not making up a part of the CIS, the ransomware executes several commands that disable and remove system backups. The commands will also look to terminate any system processes that may prevent encryption of certain file types. This is followed by the malware writing the public encryption key and the private key, as well as the file extension used to disk. Before encryption occurs, the malware will extract information including the username, hostname, OS version and keyboard layout and send those to a server under the attackers control. Once this is complete encryption begins utilizing multiple threads to drastically decrease the time to encrypt data. Finally, the wallpaper of the system is changed and the ransom note is dropped.

If you feel that you may have suddenly become a victim of Exorcist, there are a few tell-tale signs. First, the wallpaper announcing youve become a victim reads as follows:

ENCRYPTEDREAD decrypt.htafile for details

When the ransom note is opened it will read:rnyZoV DecryptAll your data has been encrypted with Exorcist Ransomware.Do not worry: you have some hours to contact us and decrypt your data by paying a ransom.To do this, follow instructions on this web site: hxxp://217.8.117.26/payAlso, you can install Tor Browser and use this web site: hxxp://4dnd3utjsmm2zcsb.onion/payIMPORTANT: Do not modify this file, otherwise you will not be able to recover your data!

Your authorization key:

An authorization key will be provided by the attacker once the ransom is paid. However, to find out what the ransom is the victim needs to download a Tor browser and visit the address provided. It is unclear if the ransom amount is fixed at 5000 USD in Bitcoin or changes from victim to victim, depending on what the attacker perceives they can pay. The website reads as follows:Exorcist RansomwareOrderIf the payment isnt made until 2020-07-25 10:33:57, decryptor price will be increased 3 times

Whats the matter?All your files have been encrypted with Exorcist Ransomware.

The only way to decrypt them back is to buy Exorcist Decryption Tool.

The price is 5000$

It will scan all your network and check all encrypted files and decrypt them.

We accept Bitcoin (BTC) cryptocurrencies.

To be sure we have the decryptor and it works you can use Free Decrypt and decrypt only one file for free. But the only file you can decrypt is image (PNG, JPG, BMP), maximum size 3 MB, because they are usually not valuable.

Instruction:You need to create a crypto wallet. You can read more about crypto wallets here: hxxps://bit.ly/379vYBtLearn how to buy cryptocurrency (Bitcoin). Some links where you can find information here:Bitcoin: hxxps://bit.ly/38nohHMCopy the wallet number from the address field (depending on what you have chosen) and transfer the necessary amount of cryptocurrency to it. You can read more about translations here: hxxps://bit.ly/36br2dKAfter paying the ransom, your files will be decrypted and you will be able to continue your work.

IMPORTANT: When transferring funds, carefully check the details to avoid errors and loss of funds. Your files will be decrypted only when transferring funds to our wallet.

Free decrypt

PaymentDecryptor price: 5000$Pay in Bitcoin:bc1qyzjj2hrjr3sspjwj9ckd02fz8kmynj9xkjrkgv0.561799 BTCWhen funds reach one of these addresses, you automatically get decryption tool.

ChatType Message

Performing a search at the time of writing on the provided address in the ransom note reveals that no funds have been transferred to this address as of yet. Given how new the ransomware is, this is not a surprise. Further, no victims have announced publicly that they have fallen victim to Exorcist to the best of this writers knowledge. It may be that Exorcist has not seen wide distribution yet, as it may still be in development or slowly ramping up operations.

While there seem to be no active campaigns making headlines at the moment, this is probably not likely to last. One bit of news that emerged recently is that a hacker released a list of IP addresses for more than 900 Pulse Secure VPN enterprise servers. The list published in plaintext also included several usernames and passwords. The release was made on a Russian underground hacker forum, which is known to have multiple ransomware gangs contributing and actively posting. The list includes Sodinokibi, NetWalker, Lockbit, Avaddon, Makop and importantly for the purposes of this article Exorcist. In general, the forum is used by the gangs to hire more developers or affiliates tasked with distributing the ransomware.

The reason why the dump of Pulse Secure VPN credentials would make headlines is that many of the above-mentioned gangs have actively been targeting known vulnerabilities in VPNs to compromise an enterprise network. As the dump was done free of charge and in plain text, those using unpatched VPN products should be worried enough to patch them as a matter of priorityit may be that in the near future major enterprises will be seeing the Exorcists wallpaper and ransom note and be visiting their website.

The main reason why the developers behind Exorcist and several other malware families tend to not want to infect computers in Russia, its neighbors, and the countrys interest in the geopolitical stage is that the Russian government turns a blind eye to cybercrime conducted by nationals, as long as Russia and its interests are not targeted. This is why a quick internet search will reveal cybercriminals wanted in the U.S. or Europe posing in front of luxury cars bought with the proceeds from their criminal activity.

Further, it seems to be the case that rather than bringing these people to justice, Russian Intelligence will employ their expertise to supplement their own cyber warfare and cyber espionage operations. These rumors began some 20 years ago and recent events seem to prove they were closer to reality, further supported by skilled coders in the CIS and their earning potential. For many, it is far more lucrative to hack and be approached by the intelligence agencies in question than to work within the IT sector. Since immunity seems to be granted to hackers as long as they leave Russian interests alone, becoming a hacker seems to be more of a logical financial decision than the perceived view by most of society as hackers being social pariahs.

This scenario was further confirmed in 2019 when the Russian government passed laws that enabled the creation of a self-contained internet modeled after the one implemented successfully in China. A report published investigating the new law and its expected effects believed that the law would help further flame the flames of cybercrime, whether state-sponsored or independent, financially motivated hackers, and further the status quo mentioned above. The funny thing is the law would make it easier to crack down on hackers within Russian borders; however, attacks on Russias rivals such as the U.S. are seen as serving Russian interests even if done by cybercriminals.

An article about the relationship between the Russian government and its hackers, as well as hackers in neighboring states, concluded:

The availability of highly skilled and technically well-versed individuals also presents a pool of potential proxies that can be mobilized at a moments notice. Often, people will mobilize themselves and take political action in support of the government, as has happened in Estonia in 2007 and in Ukraine since 2014. Governments differ in their ability to catalyze such activity and the extent to which they are in a position to merely endorse, orchestrate, or actively direct their outcomes. In countries where public institutions and the states ability to exercise control have deteriorated, it is an uphill battle to break the increasingly entrenched incentive structures reinforcing existing proxy relationships. Meanwhile, the controversy over law enforcement cooperation, including mutual legal assistance and extradition, shows the limits of international cooperation and external influence. The phenomenon described in this chapter is therefore a cautionary tale of the potential pitfalls when a state significantly weakens or collapses and the consequences that will reverberate for decades to come.

For those tasked with defending networks against Exorcist and other ransomware gangs, expecting those who committed the crime to be arrested and brought to book is a pipe dream. Rather, the focus should be to do everything possible to prevent the attack in the first place.

Recent Articles By Author

Originally posted here:
Exorcist Ransomware and CIS Exclusion - Security Boulevard

The Australian Federal Police has told the Parliamentary Joint Committee on Intelligence and Security that it has used technical assistance requests issued under the encryption law passed in December 2018 on three occasions in the financial year 2019-20, to obtain assistance from companies or individuals in breaking encryption to gain access to information needed for investigation of crimes.

Under the law, which is officially known as the Telecommunications and Other Legislation Amendment (Assistance and Access) Bill 2018, technical assistance requests seek voluntary help by a company; its staff will be given civil immunity from prosecution.

If this is not agreed to by the company in question, an interception agency can then issue a technical assistance notice or TAN to make a communications provider offer assistance based on existing functionality.

If this is not effective either in convincing the organisation in question to co-operate with law enforcement, then a technical capability notice can be issued by the Attorney-General at the request of an interception agency.

In a submission to the PJCIS, the AFP said as per previous submissions and appearances before the panel and in the review of the law by the Independent National Security Legislation Monitor, Dr James Renwick, the tempo and complexity of the criminal threat environment was evolving with increasing use of technology by criminal groups and their networks, to facilitate and obfuscate criminal conduct.

The AFP said the encryption law provided an essential framework to strengthen the AFPs ability to overcome technological impediments to lawful access to digital content, where necessary and appropriate.

For the previous financial year, the AFP said it had used the technical assistance requests on five occasions. This was in a much shorter period than the full 12 months, as the law came into effect only in December 2018; hence the period over which these five TARs were made was from December 2018 to 30 June 2019, a little more than six months.

This repositioning of our promotional stories has come about due to customer focus groups and their feedback from PR firms, bloggers and advertising firms.

Your Promotional story will be prominently displayed on the Home Page.

We will also provide you with a second post that will be displayed on every page on the right hand side for at least 6 weeks and also it will appear for 4 weeks in the newsletter every day that goes to 75,000 readers twice daily.

POST YOUR NEWS ON ITWIRE NOW!

These days our customers Advertising & Marketing campaigns are mainly focussed on Webinars.

If you wish to promote a Webinar we recommend at least a 2 week campaign prior to your event.

The iTWire campaign will include extensive adverts on our News Site itwire.com and prominent Newsletter promotion https://www.itwire.com/itwire-update.html and Promotional News & Editorial.

For covid-19 assistance we have extended terms, a Webinar Business Booster Pack and other supportive programs.

We look forward to discussing your campaign goals with you. Please click the button below.

MORE INFO HERE!

Original post:
AFP says it made three requests for assistance in breaking encryption in 2019-20 - iTWire

At Black Hat USA 2020, ESET researchers delved into details about the Krk vulnerability in Wi-Fi chips and revealed that similar bugs affect more chip brands than previously thought

Krk (formally CVE-2019-15126) is a vulnerability in Broadcom and Cypress Wi-Fi chips that allows unauthorized decryption of some WPA2-encrypted traffic. Specifically, the bug has led to wireless network data being encrypted with a WPA2 pairwise session key that is all zeros instead of the proper session key that had previously been established in the 4-way handshake. This undesirable state occurs on vulnerable Broadcom and Cypress chips following a Wi-Fi disassociation.

Figure 1. Overview of Krk following a disassociation, data is transmitted encrypted with an all zero session key

Exploiting Krk allows adversaries to intercept and decrypt (potentially sensitive) data of interest and, when compared to other techniques commonly used against Wi-Fi, exploiting Krk has a significant advantage: while they need to be in range of the Wi-Fi signal, the attackers do not need to be authenticated and associated to the WLAN. In other words, they dont need to know the Wi-Fi password.

We worked with the affected vendors (as well as ICASI) through a responsible disclosure process before we first publicly disclosed the flaw at the RSA Conference in February 2020. The ensuing publicity brought the issue to the attention of many more chipset and device manufacturers, some of which discovered they also had vulnerable products and have since deployed patches. We are maintaining a list of related vendor advisories on this webpage[1].

While we did not observe CVE-2019-15126 in other Wi-Fi chips than Broadcom and Cypress, we did find that similar vulnerabilities affected chips by other vendors. These findings were first presented at Black Hat USA 2020 and were briefly outlining them below.

One of the chips we looked at, aside from those from Broadcom and Cypress, was by Qualcomm. The vulnerability we discovered (which was assigned CVE-2020-3702) was also triggerable by a disassociation and led to undesirable disclosure of data by transmitting unencrypted data in the place of encrypted data frames much like with Krk. The main difference is, however, that instead of being encrypted with an all-zero session key, the data is not encrypted at all (despite the encryption flags being set).

The devices we tested and found to have been vulnerable are the D-Link DCH-G020 Smart Home Hub and the Turris Omnia wireless router. Of course, any other unpatched devices using the vulnerable Qualcomm chipsets will also be vulnerable.

Following our disclosure, Qualcomm was very cooperative and in July released a fix to the proprietary driver used in their officially supported products. Not all devices with Qualcomm chips use this proprietary driver, however in some cases, open source Linux drivers are used such as the upstream ath9k driver, for example. As its not actively developed by Qualcomm, its not clear at the time of writing if it will receive a patch from Qualcomm or the open-source community.

We also observed the manifestation of a similar vulnerability (i.e. lack of encryption) on some Wi-Fi chips by MediaTek.

One of the affected devices is the ASUS RT-AC52U router. Another one is the Microsoft Azure Sphere development kit, which we looked into as part of our Azure Sphere Security Research Challenge partnership. Azure Sphere uses MediaTeks MT3620 microcontroller and targets a wide range of IoT applications, including smart home, commercial, industrial and many other domains.

According to MediaTek, software patches fixing the issue were released during March and April 2020. The fix for MT3620 was included in Azure Sphere OS version 20.07, released in July 2020.

As more than five months have passed since we publicly disclosed the Krk vulnerability and several proofs-of-concept have been published by independent researchers weve decided to release the script weve been using to test whether devices are vulnerable to Krk. We have also included tests for the newer variants described here. This script can be used by researchers or device manufacturers to verify that specific devices have been patched and are no longer vulnerable.

Special thanks to our colleague Martin Kalunk, who greatly contributed to this research.

[1] If you have an advisory you would like added to this list please contact us at threatintel[at]eset.com.

See the original post:
Beyond Krk: Even more WiFi chips vulnerable to eavesdropping - We Live Security

Report of Global Cloud Encryption Technology Market is generated by Orbis Research providing the comprehensive study of the industry. Orbis Research is considering the year 2019 as a base year and forecast period for predicting the growth of the market is 2020-2026. Orbis Research is delivering the reports of market research on several categories by an organized method of judging the client, examining market supply, researching, struggle and demand, accompanied by integrating the feedback of the client.

Request a sample of this report @ https://www.orbisresearch.com/contacts/request-sample/4931738

Report of Global Cloud Encryption Technology Market is providing the summarized study of several factors encouraging the growth of the market such as manufacturers, market size, type, regions and numerous applications. By using the report consumer can recognize the several dynamics that impact and govern the market. For any product, there are several companies playing their role in the market, some new, some established and some are planning to arrive in the Global Cloud Encryption Technology Market. The report provides the complete study of the Global Cloud Encryption Technology Market considering the approaches used by industrialists. There are some specific strategies used to safeguard their space in market and enduring the growth of business are the factors covered in the report. The report is describing the several types of Cloud Encryption Technology Industry. Factors that are encouraging the growth of specific type of product category and factors that are motivating the status of the market. A comprehensive study of the Cloud Encryption Technology Market is done to recognize the several applications of the features of products and usage. Report is providing the detailed study of the facts and figures, as readers are searching for the scope in market growth related to the category of the product. A report is also covering the details on market acquisitions, mergers and significant trends are influencing the growth of the market in the coming years.

Manufacturer Detail

GemaltoSophosSymantecSkyHigh NetworksNetskope

Browse the complete report @ https://www.orbisresearch.com/reports/index/global-cloud-encryption-technology-market-size-status-and-forecast-2020-2026

Report of Global Cloud Encryption Technology Market is providing a thorough study of several factors that are responsible for market growth and factors that can play a major role in the growth of the market in the forecast period. The report of Global Cloud Encryption Technology Industry is delivering the detailed study on the basis of market revenue share, price and production occurred. The Cloud Encryption Technology Market report provides the summary of the segmentation on the basis of region, considering the details of revenue and production pertaining to market.

By Type

SolutionServices

By Application

BFSIHealthcare and LifesciencesMedia and EntertainmentRetail and E commerceAutomotive and ManufacturingIT and Telecom

The in-depth report on Cloud Encryption Technology Market by Orbis Research provides readers with an overview of the market and assists consumers to study the other significant factors impacting the Global Cloud Encryption Technology Market.

Make an enquiry of this report @ https://www.orbisresearch.com/contacts/enquiry-before-buying/4931738

About Us :

Orbis Research (orbisresearch.com) is a single point aid for all your market research requirements. We have vast database of reports from the leading publishers and authors across the globe. We specialize in delivering customized reports as per the requirements of our clients. We have complete information about our publishers and hence are sure about the accuracy of the industries and verticals of their specialization. This helps our clients to map their needs and we produce the perfect required market research study for our clients.

Contact Us :

More here:
Cloud Encryption Technology Market 2020 Segmented by Major Players, Types, Growth, Applications and Forecast to 2026 - Chelanpress

In the latest E-mail Encryption market report, numerous aspects pivotal to the industry augmentation in the recent past as well as the key global developments are analyzed to help businesses stay ahead of the curve. The research document has been put together in a manner that aids companies in better understanding the prevailing trends and identifying future growth prospects to make well-informed decisions.

Key growth drivers and opportunities that are slated to influence to profitability graph of the industry over the assessment period are highlighted in the report. Moreover, it suggests strategies to tackle the challenges and threats plaguing the business sphere.

Projected growth rate of the industry over the analysis timeline, backed with a comparative study of the historical data and current market scenario is included. Additionally, the impact of the COVID-19 pandemic at the global and regional level has been outlined in the report.

Request Sample Copy of this Report @ https://www.express-journal.com/request-sample/162746

Key Pointers indexed in TOC:

Product terrain

Application scope

Regional landscape

Competitive arena

The E-mail Encryption market, in brief, has been rigorously studied through multiple fragmentations, while keeping track of industry supply chain and sales channel with respect to the raw materials, upstream suppliers, distributors, and downstream buyers.

Reasons for buying this report:

The key questions answered in this report:

Significant Point Mentioned in theResearch report:

Major Points Covered in Table of Contents:

Request Customization on This Report @ https://www.express-journal.com/request-for-customization/162746

More:
E-mail Encryption Market 2020 Global Outlook, Research, Trends and Forecast to 2026 - Express Journal