Set 11, 2024 Marina Londei Attacchi, In evidenza, Malware, News, RSS 0

---

I ricercatori di Trend Micro hanno individuato una serie di attacchi a opera di un gruppo di hacker contro obiettivi dell’industria militare, in particolare contro i produttori di droni di Taiwan. Il cluster di attaccanti, denominato TIDRONE dai ricercatori, è attivo da inizio 2024 e usa diversi toolset malware per attività di spionaggio.

Stando all’analisi di Trend Micro, nei primi mesi dell’anno il gruppo ha colpito principalmente fornitori di servizi di pagamento di Taiwan, mentre da poco prima dell’estate ha spostato l’attenzione verso l’industria militare e dei satelliti.

TIDRONE utilizza due payload malware: CXCLNT e CLNTEND, entrambe backdoor. La prima è in grado di raccogliere informazioni come l’indirizzo IP e MAC del dispositivo compromesso, il nome del computer e l’architettura di sistema per inviarle agli attaccanti; inoltre, possiede capacità di upload e download dei file, probabilmente allo scopo di eseguire payload aggiuntivi.

CLNTEND viene usata invece principalmente per l’accesso remoto e supporta una serie di protocolli di comunicazione quali TCP, HTTP, HTTPS, TLS e SMB (port:445).

Secondo i ricercatori di Trend Micro, il gruppo ha sfruttato UltraVNC, un programma per il controllo remoto dei dispositivi, per distribuire i payload malevoli. “Durante la nostra indagine abbiamo scoperto che lo stesso sistema ERP era presente negli ambienti di diverse vittime, il che suggerisce che il malware sia stato distribuito tramite un attacco supply chain“.

Il team di Trend Micro ritiene che TIDRONE sia un gruppo di attaccanti cinese, al momento non ancora identificato con certezza.

Per proteggersi da questi attacchi, i ricercatori consigliano di scaricare software solo da origini conosciute e legittime, prestare molta attenzione alle tecniche di social engineering e utilizzare software di sicurezza robusti che riescano a individuare i primi segnali di compromissione nel sistema.

---

---

---

https://www.securityinfo.it/2024/09/11/nuovi-attacchi-prendono-di-mira-industria-militare-taiwan/?utm_source=rss&utm_medium=rss&utm_campaign=nuovi-attacchi-prendono-di-mira-industria-militare-taiwan

A fine agosto ha fatto molto scalpore la notizia dell’arresto di Pavel Durov, fondatore e CEO di Telegram.

Nata nel 2013, l’app di messaggistica è oggi la seconda più utilizzata al mondo con 950 milioni di profili attivi (la prima, con oltre 2 miliardi di utenti, rimane per ora Whatsapp).

Data la notorietà del suo protagonista – incluso da Forbes tra le 150 persone più ricche del pianeta – la vicenda ha suscitato pareri discordanti e accese valutazioni.

A far discutere sono le potenziali ricadute rispetto alla responsabilità delle piattaforme per i contenuti pubblicati, soprattutto alla luce delle nuove previsioni comunitarie in materia, come quelle previste dal Digital Service Act o DSA.

Sebbene sia stato rilasciato su cauzione pochi giorni dopo, Durov è tuttora indagato per 12 capi di imputazione, tra cui il possesso e la distribuzione di materiale pedopornografico rinvenuto su diversi canali Telegram; di conseguenza, si è visto imporre il divieto di lasciare il territorio francese fino al termine dell’indagine.

Le ultime novità sul procedimento e i commenti di Durov

Il 5 settembre ulteriori aggiornamenti sono stati condivisi proprio su Telegram tramite il Du Rove’s Channel, che conta quasi 13 milioni di iscritti.

Dopo aver ringraziato per il supporto ricevuto, Durov ha riferito di essere stato interrogato per 4 giorni dalla polizia parigina in merito alla sua possibile responsabilità “for other people’s illegal use of Telegram”, nonché per le mancate risposte conseguenti alle richieste formulate dalle autorità francesi.

Ciò viene definito “sorprendente” per diverse ragioni:

1. Telegram avrebbe già da tempo nominato un rappresentante ufficiale nell’Unione Europea e i relativi contatti sono pubblicamente disponibili tramite una semplice ricerca online.
2. Le autorità inquirenti avrebbero avuto vari modi per contattare Durov, il quale, essendo cittadino francese (ed emiratino) frequentava regolarmente il consolato di Parigi a Dubai. Inoltre, poco tempo fa, lo stesso si sarebbe personalmente speso per favorire ogni comunicazione volta a contrastare la minaccia terroristica in Francia.
3. Se un Paese intende contestare le scelte di un internet service, la prassi prevede un’azione legale contro il servizio stesso; al contrario, ricorrere a normative antecedenti all’era digitale al fine di incriminare un CEO per reati commessi da terzi sulla piattaforma che dirige rappresenterebbe “a misguided approach”. Anche perché “Nessun innovatore creerebbe nuovi strumenti sapendo di poter essere ritenuto responsabile di un loro uso scorretto”.

Il messaggio prosegue evidenziando la difficoltà di individuare il giusto equilibrio tra privacy e sicurezza e la necessità di conciliare le regole in tema di privacy con le richieste delle forze dell’ordine, nonché le leggi locali con le normative UE.

Rispetto ai limiti tecnologici ed etici (“As a platform you want your processes to be consistent globally, while also ensuring they are not abused in countries with weak rule of law”), si assicura di aver sempre provato a dialogare con le autorità alla ricerca dei necessari compromessi.

Tuttavia, prosegue Durov, “We stand by our principles: our experience is shaped by our mission to protect our users in authoritarian regimes”.

Si afferma altresì di non poter concordare con ogni scelta nazionale circa il suddetto equilibrio privacy/sicurezza, ricordando come in diversi casi Telegram abbia scelto di abbandonare il Paese in questione: “When Russia demanded we hand over encryption keys to enable surveillance, we refused — and Telegram got banned in Russia. When Iran demanded we block channels of peaceful protesters, we refused — and Telegram got banned in Iran […] We are driven by the intention to bring good and defend the basic rights of people, particularly in places where these rights are violated”.

Il futuro di Telegram: nuove funzionalità e più moderazione sui contenuti

Dopo aver ribadito che Telegram non è un servizio perfetto e che restano molte cose – tra cui proprio il dialogo con le autorità – da migliorare, nella comunicazione si sottolinea come esistano già dei meccanismi di moderazione sui contenuti pubblicati.

Al riguardo, infatti, si afferma: “The claims in some media that Telegram is some sort of anarchic paradise are absolutely untrue. We take down millions of harmful posts and channels every day. We publish daily transparency reports [and] We have direct hotlines with NGOs to process urgent moderation requests faster”.

Rispetto al futuro, il CEO promette di ascoltare chi ritiene insufficienti gli attuali meccanismi di moderazione e dichiara d’essersi posto il personale obiettivo di migliorarli significativamente (“We’ve already started that process internally, and I will share more details on our progress with you very soon”).

A pesare sulla recente gestione della piattaforma sarebbe stato anche l’improvviso aumento degli iscritti, che ha complicato il monitoraggio dei contenuti rendendo più semplice il verificarsi di illeciti o di abusi.

In conclusione si esprime la speranza che le attuali vicissitudini possano rendere la piattaforma – nonché l’intera industria dei social network – “safer and stronger”.

Nella stessa direzione sembrano andare gli annunci di nuove funzionalità e le dichiarazioni formulate su X (già Twitter) dove pochi giorni fa, celebrando il traguardo dei 10 milioni di iscritti a Telegram Premium, Durov ha affermato: “Per quanto il 99,999% degli utenti non abbia nulla a che fare con la criminalità lo 0,001% coinvolto in attività illecite crea una cattiva immagine per l’intera piattaforma, mettendo a rischio gli interessi del nostro quasi miliardo di utenti. Ecco perché quest’anno ci siamo impegnati a far sì che la moderazione su Telegram, da oggetto di critica, diventi motivo di elogio”.

https://www.ictsecuritymagazine.com/notizie/la-versione-di-durov-come-cambiera-telegram-alla-luce-delle-indagini-sul-suo-ceo/

Risk management was analyzed in a recent report by AuditBoard. The study revealed that expanding expectations are coming at a time when internal audit has limited bandwidth for advisory-related services — and increasing risk demand and insufficient risk management capacity are creating a risk coverage gap for the business.

The report looks at where internal audit teams are currently spending the majority of their time, and where adjustments could be made to help shift focus to value-added, risk-related activities. Key findings include:

Information security control testing appears to be growing in practice, with 82% of chief audit executives (CAEs) involved in some capacity and 44% either owning or heavily involved. Twenty-eight percent of CAEs either own or are heavily involved with continuous monitoring of a key process, but 60% of surveyed auditors have some level of involvement in ERM — and 40% have no involvement whatsoever.

More than half (55%) of CAEs indicate that their administrative reporting managers (typically CFOs and CEOs) have asked internal audit teams to be involved in more activities in the past two years, including ERM, ESG, governance, operational initiatives, and quality assurance.

While surveyed CAEs identified integrated risk management (IRM) as their top area for increasing responsibilities, most organizations still have a long way to go toward IRM maturity. IRM was CAEs’ top response for where they should be more involved.

Ninety-six percent of organizations lack mature IRM programs, and 11% of organizations report having no IRM strategy whatsoever, with audit, risk and compliance functions working independently, while 51% of organizations seem to know IRM is needed, but have no cohesive strategy for it.

Another 24% have no formal strategy, but say they’re actively working toward connecting audit, risk, and compliance functions. This finding is promising, reflecting a recognition of the need for IRM even if they aren’t yet using the specific term.

Read the report

https://www.securitymagazine.com/articles/101015-it-leaders-stress-the-need-for-stronger-risk-management

Generative artificial intelligence (GenAI) was analyzed in a recent report by Transmit. The report includes screenshots of dark web forums, marketplaces and subscription-based services. 

According to the report, Blackhat Gen-AI tools make it easier to create and automate fraud campaigns, resulting in an increased volume, velocity and variety of attacks. GenAI tools automate pentesting to find enterprise vulnerabilities and circumvent security used by specific targets.

Configuration (config) files, generated with the assistance of GenAI, are used for validating accounts and can validate up to 500 credentials per minute, according to the report. Bundled services like Remote Desktop Protocols (RDPs) and credit card checkers are augmented by AI to streamline attack creation.

The report found that GenAI rapidly generates real or synthetic identity data to create hard-to-detect fraudulent accounts aged with eight-plus years of order history to appear legitimate. GenAI makes it easy to create high-quality fake IDs that are able to bypass security checks, including most AI-driven identity verification.

Video and voice deepfakes lure victims into scams, while voice cloning is able to trick call center voice authentication systems, according to the report. Dark web markets offer 24/7 escrow and high seller ratings up to 4.99/5 to assure purchasers of product efficacy.

The report included advise to mitigate GenAI threats, such as implementing fraud prevention, identity verification and customer identity management services.

GenAI can be beneficial as a fraud analytics tool and can be used to query an organization’s identity data to generate graphs or insights about end users, devices, risk or trust events, attack types and other information — to adapt to rapidly-emerging trends.

Read the report

https://www.securitymagazine.com/articles/101014-generative-ai-poses-several-security-risks

Governor Kathy Hochul of New York signed legislation to protect and support the growth of the state’s workforce. 

“Coming from a union family, I know how critical organized labor is to building a strong middle class,” remarks Governor Hochul. “As we celebrate today’s Labor Day Parade in New York City, we are strengthening our commitment to working families and letting them know we have their backs every step of the way.”

There are eight pieces of legislation associated with this goal:

1. S.8358C/A.8947C: This is the Retail Worker Safety Act, requiring employers provide employee training and information to prevent workplace violence. This training will be based on a model provided by the State’s Department of Labor. Furthermore, employers of 500 employees statewide must have a silent alarm accessible to employees in the event of an emergency.
2. S.8948/A.9935: Judgements regarding an employee’s inability to perform their job due to a disability must be given to the employee and their representative. 
3. S.8557/A.9386: A public employees can qualify for promotional civil service examination for appointment from an eligible list via provisional credit. 
4. S.5085C/A.4066B: This legislation mandates automobile manufacturers will reimburse dealerships in accordance with retail labor time guides.
5. A.9265A/S.8608A: This requires contractors and subcontractors of covered public projects to submit payrolls and transcripts to a public database developed by the Department of Labor.
6. S.5500B/A.6146B: State agencies must develop a policy to notify employees of freedom of information requests for public disciplinary records.
7. S.8216A/A.8876: Competitive civil service exams may be taken within 12 months of the required age or educational criteria for the position. 

8. S.8551/A.9349: Civil service exam questions must be reviewed and updated by the Department of Civil Service at least every five years. 

Cynthia Marble, Senior Director, Threat Assessment and Management at Ontic, comments, “With similarities to the Workplace Violence Prevention Act that was passed by the state of California last year, NY state is requiring some employers to establish a proactive position of preparation and prevention when it comes to matters of workplace safety. The Retail Worker Safety Act requires corporate retail employers to adopt violence prevention plans, train workers in de-escalation techniques, and provide active shooter training.

“To prepare, retailers should develop a workplace violence prevention plan that details how to address employee concerns about violence, provides instructions for how employees should report incidents, and provides guidance on when to call law enforcement, use panic buttons, or alert individuals in the case of an emergency. Companies also need to ensure that they are tracking any investigations conducted on the reported incidents or threats so that they can continually monitor situations in real time. Having a robust system of record that can house information about these incidents can help retailers identify and address problem areas such as a high volume of incidents in a certain store location, aggressive behaviors directed towards employees, changes in policies or procedures, etc. With the passage of the Retail Worker’s Safety Act, retailers have the opportunity to be better prepared to address workplace violence concerns and minimize risk.

“Now that the law has been passed, all employers, not just those directly affected by its passage, should consider doing a health check of their current workplace violence prevention program.  And if they don’t have one, see this as an opportunity to establish policies and procedures that meet best practice in workplace violence prevention.  Employers should ensure their employees know how to recognize behavior that may be concerning and know how and where to report it.  There should be procedures for investigating concerns so that the appropriate measures can be taken to address them. And lastly, employers need to have a secure method to log concerns, memorialize investigations, and have a record of steps taken to mitigate risk.” 

https://www.securitymagazine.com/articles/101026-new-york-establishes-new-legislation-for-workplace-safety

Research identified a malvertising campaign targeting employees of Lowe’s. The malvertising campaign, leveraging Google ads, seeks to access current and former employee credentials. These Google ads appear when a Google Search is done for the Lowe’s internal HR portal, MyLowesLife. The URLs for these Google ads closely resemble the legitimate URL for the HR portal website and may deceive a target into clicking them. 

Once a target clicks on the ad, they will be taken to a phishing page. This page matches the structure of the legitimate MyLowesLife website. There, the target will be prompted to input their sales number and password. Then, targets are directed to input their security question. The information inputted into the phishing website is then transferred to the threat actor and the target is redirected to the legitimate website, where they will be prompted to login again. While this could raise suspicion for some users, many may believe the website simply glitched and will not give the occurrence a second thought. 

“The danger here lies in the fact that many individuals trust mainstream search engines as reliable, assuming that the first result, regardless of it being sponsored, is legitimate. This misplaced trust leads to users clicking on fraudulent sites, which is exactly what threat actors exploit,” says Max Gannon, Cyber Intelligence Team Manager at Cofense. “This malvertising campaign serves as an important reminder to stay vigilant and exercise caution when engaging in sponsored search results. It is important to always verify the authenticity of a website or enter the full domain into your browser before entering any credentials.”

This threat is not limited to Lowe’s employees, according to the research, as threat actors are targeting other organizations with similar tactics. 

https://www.securitymagazine.com/articles/101025-lowes-employees-targeted-with-malvertising-campaign

Set 10, 2024 Marina Londei Attacchi, In evidenza, Malware, News, RSS 0

---

I ricercatori di ESET hanno individuato una campagna ai danni degli utenti Android che mira a clonare le carte di debito e credito delle vittime. Il malware, denominato NGate dai ricercatori, sfrutta un’applicazione malevola installata sugli smartphone per raccogliere e inviare i dati delle carte di pagamento agli attaccanti.

I cybercriminali usavano i dati dell’NFC delle carte di pagamento fisiche per effettuare transazioni bancomat, prelevando denaro dagli sportelli. In caso di fallimento, gli attaccanti usavano un piano di riserva per trasferire i fondi.

“Non abbiamo mai visto questa tecnica di reindirizzamento NFC in nessun malware Android precedentemente scoperto. La tecnica si basa su uno strumento chiamato NFCGate, progettato da studenti del Politecnico di Darmstadt, in Germania, per catturare, analizzare o alterare il traffico NFC; per questo abbiamo chiamato questa nuova famiglia di malware NGate” ha spiegato Lukáš Štefanko, Senior Malware Researcher di ESET.

Gli utenti colpiti avevano compromesso i propri dispositivi scaricando e installando un’applicazione Android da un link contenuto in un SMS fraudolento relativo a un presunto rimborso fiscale.

NGate è legato ad attività di phishing di un gruppo che ha operato in Repubblica Ceca da novembre 2023; ESET ritiene però che queste attività si siano interrotte dopo l’arresto di una persona sospetta lo scorso marzo.

Il malware Android è stato distribuito tramite domini di breve durata che simulavano siti web bancari legittimi o applicazioni bancarie ufficiali. Gli attaccanti hanno sfruttato le Progressive Web App per affinare le proprie strategie e pubblicare in seguito delle WebAPK, versioni più sofisticate delle normali applicazioni web.

Dopo l’installazione, NGate mostra un sito web falso che richiede all’utente di inserire le sue informazioni bancarie, le quali vengono poi inviate al server dell’attaccante. Oltre all’invio dei dati NFC, un cybercriminale con accesso fisico alle carte di pagamento potrebbe copiarle ed emularle, per esempio leggendole attraverso borse o portafogli.

“Proteggersi da attacchi complessi come questi richiede l’uso di misure proattive contro il phishing, social engineering e malware Android. Questo significa controllare gli URL dei siti web, scaricare app solo da store ufficiali, mantenere segreti i codici PIN, utilizzare app di sicurezza sui telefoni, disattivare la funzione NFC quando non è necessaria, utilizzare custodie protettive o carte virtuali protette da autenticazione” conclude Štefanko.

---

---

---

https://www.securityinfo.it/2024/09/10/eset-scopre-ngate-malware-per-android-che-sfrutta-lnfc-per-clonare-le-carte-di-pagamento/?utm_source=rss&utm_medium=rss&utm_campaign=eset-scopre-ngate-malware-per-android-che-sfrutta-lnfc-per-clonare-le-carte-di-pagamento

@import url(‘https://fonts.googleapis.com/css2?family=Nunito+Sans:ital,opsz,wght@0,6..12,400;0,6..12,500;0,6..12,600;0,6..12,700;1,6..12,400;1,6..12,500;1,6..12,600;1,6..12,700&family=Nunito:ital,wght@0,400;0,500;0,600;0,700;1,400;1,500;1,600;1,700&display=swap’);
@import url(‘https://fonts.googleapis.com/css2?family=Architects+Daughter&family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&display=swap’);
h3 {font-weight: bold;font-size: 18px;color: #C72026;}
figure {padding: 4px;margin: auto;}
figcaption {background-color: #f8f8f8;color: #404144;Nunito Sans’, Arial, sans-serif;font-size: 16px;padding: 2px;text-align: center;}
.pqFull { display: block; border-width: 2px 0; border-style: solid; border-color: #404144; padding: 1.5em 0 0.5em; margin: 1.5em 0; position: relative; Architects Daughter’, Arial, sans-serif; font-size: 21px; text-align: center; color:#0067A6; } .pqFull:before { content: ‘\201C’; position: absolute; top: 0em; left: 50%; transform: translate(-50%, -50%); background: #fff; width: 3rem; height: 2rem; color: #666; text-align: center; } .pqFull:after { content: ; display: block; text-align: center; font-size: 18px; color: #404144; }

The convergence of physical security and cybersecurity:

In an era where technology permeates every aspect of our lives and our daily devices and tools are connected, the convergence of physical security and cybersecurity has emerged as a critical consideration across all industries and sectors. What is rapidly arising is the universal need for an integrated approach to physical and cybersecurity.

The high stakes of cyber-physical integration

Cybersecurity is often perceived as a safeguard for data and systems, with an underlying assumption that physical harm is unlikely. However, the integration of physical and cybersecurity is particularly crucial in manufacturing, healthcare or infrastructure environments dealing with heavy machinery or devices that may be connected to a central system or technological oversight. Cyberattacks in these environments can have devastating consequences. For instance, in industrial plants, a cyberattack can disrupt machinery, leading to operational downtime or even physical harm to employees. States and organized crime groups have exploited these vulnerabilities, underscoring the need for a robust, integrated security strategy.

The healthcare sector provides a stark example of the high stakes involved. Cyberattacks on hospitals can be life-threatening, as they can impede access to critical medical data and systems. In such cases, the convergence of physical and cybersecurity is not just a matter of protecting information but also safeguarding lives.

Cyberattacks on hospitals can be life-threatening, as they can impede access to critical medical data and systems. In such cases, the convergence of physical and cybersecurity is not just a matter of protecting information but also safeguarding lives.

Access control: The linchpin of convergence

Traditionally, access control was a physical security measure, but with the advent of digital systems, it has evolved into a complex intersection of both physical and cyber domains. Modern access control systems are predominantly digital, managing the entry and exit points of physical spaces through electronic means. However, a significant challenge arises when clients who specialize in physical security make recommendations without accounting for cybersecurity gaps. This oversight can lead to vulnerabilities, as access control systems can be a prime target for cyberattacks.

Consider the scenario where a physical security consultant installs a camera to monitor a reception desk area. While the intent is to enhance security, this setup can inadvertently capture sensitive information such as itineraries, addresses and potential risks to senior leaders. If this footage is not secured, encrypted or properly monitored, it becomes a treasure trove for cybercriminals. Therefore, it is imperative to address cybersecurity concerns alongside physical security measures to ensure comprehensive protection.

Collaboration and cultural shifts

One of the significant challenges in achieving effective convergence is the disconnect between physical security and cybersecurity practitioners. Often, these two groups operate in silos, with limited understanding of each other’s domains. To bridge this gap, Chief Security Officers (CSOs) and Chief Information Security Officers (CISOs) must collaborate closely, ideally both reporting directly to the CEO and represent to core of the risk management committee, working together in coordinated fashion. This unified approach ensures that all risks are considered and managed holistically at the leadership level.

However, achieving such collaboration requires a cultural shift in the perception of risk. The traditional siloed approach is no longer sufficient, as modern attacks are increasingly sophisticated and cohesive. The industry must evolve to stay ahead of these threats, fostering a culture of collaboration and clear ownership and accountability.

Designing security from the ground up

To truly integrate physical and cybersecurity, security considerations must be embedded at the design phase of systems and technologies. Engaging cybersecurity teams as sounding boards during the design and implementation stages of this process ensures that potential vulnerabilities are identified and addressed early. This proactive approach leads to greater collaboration and more robust security solutions.

A shift in perception around how we design for security is essential. Rather than viewing physical and cyber domains as separate entities, they must be seen as interconnected components of a comprehensive security strategy. By fostering collaboration, addressing gaps in understanding, and integrating security measures from the outset, organizations can better protect their assets, data and people.

https://www.securitymagazine.com/articles/101006-a-unified-approach-to-risk-management

@import url(‘https://fonts.googleapis.com/css2?family=Nunito+Sans:ital,opsz,wght@0,6..12,400;0,6..12,500;0,6..12,600;0,6..12,700;1,6..12,400;1,6..12,500;1,6..12,600;1,6..12,700&family=Nunito:ital,wght@0,400;0,500;0,600;0,700;1,400;1,500;1,600;1,700&display=swap’); h3 { font-weight: bold; font-size: 18px; color: #C72026; } figure { padding: 4px; margin: auto; } figcaption { background-color: #f8f8f8; color: #404144; Nunito Sans’, Arial, sans-serif; font-size: 16px; padding: 2px; text-align: center; } /* These contain the individual column contents. */ .columnContainer { display: inline-block; margin: 10px; width: 46%; vertical-align: top; text-align: left; } /* This media query block makes the column widths 45% at a screen width of 720px, allowing for two columns. */ @media screen and (max-width: 720px) { .columnContainer { width: 45%; } } /* This media query block sets the column widths to auto, which fills the screen but allows for margins, at a screen width of 450px, allowing for one column.
This is really the only media query block you will need.*/ @media screen and (max-width: 450px) { .columnContainer { width: auto; } }

GSX — held this year from September 23 through September 25 in Orlando, Florida — provides security leaders an opportunity to network and discuss current security trends. Security magazine highlights some of the products featured at this year’s conference.

---

Altronix

Improve Access Control Deployments

The NetWay5PQ from Altronix is a 5-port Managed hardened PoE+ switch designed to enhance the efficiency of access control deployments. This compact switch board powers up to four IP devices such as access controllers and cameras via a single Ethernet cable. In addition to providing four PoE/PoE+ output ports and an Ethernet/data port, the NetWay5PQ also features embedded LINQ Technology for remote monitoring, control, and reporting of power diagnostics. This includes capabilities to reset devices, receive alerts/notifications and log event history, making it suitable for installations where space is limited and remote management is required. Image courtesy of Altronix
Find out more at altronix.com

Babel Street

Monitor Risks Using Analytics

Babel Street Insights delivers advanced AI and data analytics solutions that enable users to search, aggregate, and integrate open-source intelligence (OSINT) data — including publicly and commercially available information (PAI/CAI) — to close the Risk-Confidence Gap. With the 2024 release of Elite Regional Access, Babel Street now empowers users to zoom in on communities, events, and trends that are often obscured or completely inaccessible within broader global data sets for deeper insights to help mitigate risks, optimize operations, and gain a competitive edge in rapidly evolving landscapes. Image courtesy of Babel Street
Find out more at babelstreet.com

---

---

Boon Edam

Secure Sensitive Data and Spaces

Boon Edam’s Circlelock “Solo” is a turnkey, mantrap portal solution that provides security for sensitive locations, such as data centers. Only one user can pass through the Circlelock due to the reliable near-infrared and optical detection technology of StereoVision. The Circlelock Solo supports multi/two-factor authentication, including a variety of biometric technologies, ensuring that both the credential and identity are confirmed. Image courtesy of Boon Edam
Find out more at boonedam.com/en-us

---

---

Corbin Russwin

Stregthen Locks for Enhanced Security

The Corbin Russwin ML2000 Series with Motorized Electric Latch Retraction (MELR) mortise locks are tailor-made for the demands of commercial, institutional, and industrial environments. Designed for dependable operation, code compliance and resistance to physical abuse, they offer seamless compatibility with any access control application using standard mortise locks. From in-swing to out-swing doors, they facilitate both push and pull operations and latch retraction capable of withstanding pressure up to 50lbs. Image courtesy of Corbin Russwin
Find out more at corbinrusswin.com/en

GuardaWorld

Alert Users of Nearby Threats

ECAMSECURE’s Digital Signage for Mobile Surveillance Units serves multiple purposes: a visual deterrent, a display broadcasting essential instructional messaging and even promoting businesses’ offerings. Whether it’s alerting trespassers to vacate a restricted area or welcoming visitors to a parking lot, the unit reacts swiftly and effectively to the surrounding environment, ensuring both enhanced security and effective communication. Image courtesy of Guardaworld
Find out more at garda.com

---

---

IDIS

Reduce False Camera Alarms

The new IDIS Edge AI camera range reduces false alarms and improves the responsiveness and operational efficiency of security teams with faster forensic search and investigation. Plug-and-play and NDAA compliant, the cameras are equipped with the IDIS Deep Learning Engine on the edge. Image courtesy of IDIS
Find out more at idisglobal.com

---

---

ONTIC

Manage Security Operation Centers

Ontic’s Converged Security Operations Console is a centralized technology solution for teams across corporate security functions to establish a common view of situational awareness for unified management. Global Security Operations Centers (GSOCs) get a complete view of signals from OSINT activity, weather analysis, public events, geo-risk devices, systems, and stored data for always-on threat visualization and monitoring with coordinated workflows for actionable risk intelligence and incident response. The solution allows teams to analyze data in relation to public records, people and assets, incidents, and more to activate playbooks, enable their guard force, and use mass notification when necessary. Image courtesy of Ontic
Find out more at ontic.co

---

---

SARGENT

Ensure Doors are Locked

SARGENT announces the 10X Line bored locks now with visual status indicators. These indicators offer confirmation of a door’s locked/unlocked status. Available in multiple functions, including keyed and privacy, these locks are built for new and retrofit projects, exceed industry standards for ANSI/BHMA Grade 1 durability, and fit standard bored lock prep. Image courtesy of SARGENT
Find out more at sargentlock.com/en

---

https://www.securitymagazine.com/articles/101007-product-spotlight-gsx-2024-product-preview

A cybersecurity researcher discovered an exposed Confidant Health database containing thousands of records such as personal identifiable information, psychosocial assessment documents, health insurance information, ID cards, and more. In total, the database contained 126,276 files (equivalent of 5.3 terabytes). A separate folder contained 1,755,571 logging records. Some of these files contain audio and video files. 

The research indicates the database was not protected by a password. Therefore, this database could be accessed without a password via the internet. While not every document in the database was exposed, there is still a risk of malicious actors knowing file paths and storage details for additional patient information. Furthermore, the accessible files, viewable with just a web browser, contained private and sensitive information of patients.

For Confidant Health patients concerned their data may have been exposed, the research encourages them to change passwords for online accounts and to contact insurance providers for a new account number. 

https://www.securitymagazine.com/articles/101022-confidant-health-database-exposed-53-terabytes-of-patient-information