Connect with us

E-Business

HP Threat Research Shows Attackers Exploiting Zero-Day Vulnerability Before Enterprises Can Patch

Published

on

Kindly share this post

HP Inc. has released its latest global HP Wolf Security Threat Insights Report, providing analysis of real-world cybersecurity attacks. By isolating threats that have evaded detection tools and made it to user endpoints, HP Wolf Security has a unique insight into the latest techniques being used by cybercriminals.

The HP Wolf Security threat research team found evidence that cybercriminals are mobilizing quickly to weaponize new zero-day vulnerabilities.

Exploits of the zero-day CVE-2021-40444 – a remote code execution vulnerability that enables exploitation of the MSHTML browser engine using Microsoft Office documents – were first captured by HP on September 8, a week before the patch was issued on September 14.

By September 10 – just three days after the initial threat bulletin – the HP threat research team saw scripts designed to automate the creation of this exploit being shared on GitHub.

Unless patched, the exploit enables attackers to compromise endpoints with very little user interaction. It uses a malicious archive file, which deploys malware via an Office document.

Users don’t have to open the file or enable any macros, viewing it in File Explorer’s preview pane is enough to initiate the attack, which a user often will not know has happened. Once the device is compromised, attackers can install backdoors to systems, which could be sold on to ransomware groups.

Other notable threats isolated by the HP Wolf Security threat insight team include a rise in cybercriminals using legitimate Cloud and web providers to host malware, JavaScript malware slipping past detection tools, and targeted campaign found posing as the Ugandan National Social Security fund. The team also that switching to HTA files spreads malware in a single click.

“The average time for a business to apply, test and fully deploy patches with the proper checks is 97 days, giving cybercriminals an opportunity to exploit this ‘window of vulnerability’.

While only highly capable hackers could exploit this vulnerability at first, automated scripts have lowered the bar for entry, making this type of attack accessible to less­ knowledgeable and resourced threat actors.

This increases the risk to businesses substantially, as zero-day exploits are commoditized and made available to the mass market in venues like underground forums,” explains Alex Holland, Senior Malware Analyst, HP Wolf Security threat research team, HP Inc.

“Such novel exploits tend to be effective at evading detection tools because signatures may be imperfect and become obsolete quickly as the understanding of the scope of an exploit changes.

“We expect threat actors to adopt CVE-2021-40444 as part of their arsenals, and potentially even replace common exploits used to gain initial access to systems today, such as those exploiting Equation Editor.”

“We are also seeing major platforms like OneDrive allowing hackers to conduct ‘flash in the pan’ attacks.

While malware hosted on such platforms are generally taken down quickly, this does not deter attackers because they can often achieve their objective of delivering malware in the few hours the links are live,” Holland continues. “Some threat actors are changing the script or file type they are using every few months.

“Malicious JavaScript and HTA files are nothing new, but they are still landing in employee inboxes, putting the enterprise at risk. One campaign deployed Vengeance Justice Worm, which can spread to other systems and USB drives.”

The findings are based on data from the millions of endpoints running HP Wolf Security. HP Wolf Security tracks malware by opening risky tasks in isolated, micro Virtual Machines (micro VMs) to understand and capture the full infection chain, helping to mitigate threats that have slipped past other security tools.

This has let customers click on over 10 billion email attachments, web pages, and downloads with no reported breaches. By better understanding the behavior of malware in the wild, HP Wolf Security researchers and engineers can bolster endpoint security protection and overall system resilience.

“We can’t keep relying on detection alone. The threat landscape is too dynamic and, as we can see from the analysis of threats captured in our VMs, attackers are increasingly adept at evading detection,” comments Dr. Ian Pratt, Global Head of Security for Personal Systems, HP Inc.

“Organizations must take a layered approach to endpoint security, following zero trust principles to contain and isolate the most common attack vectors like email, browsers, and downloads. This will eliminate the attack surface for whole classes of threats, while giving organizations the breathing room needed to coordinate patch cycles securely without disrupting services.”


Kindly share this post

Dear Reader, Your support matters. But we believe that technology makes life more exciting and helps improve the lives of people around Nigeria and indeed the world. That is why, we have devoted our energy to independent reportage of technology and finance and how they affect lives. Our incisive and analytical view of how technology news affects the daily life help individuals and organizations make up their minds. Quality journalism costs money. Today, we're asking that you support us to do more. Kindly support our effort to deliver technology and finance journalism to everyone in the world. Donate as little as N1,000. Bank transfers can be made to: UBA Plc 1017156876 Communication Week Media Ltd

E-Business

Konga, CeraVe Ink MoU for Exclusive Launch of L’Oreal Product in Nigeria

Published

on

Kindly share this post

At long last, relief is here for the skincare enthusiasts in Nigeria! Konga Health, Nigeria’s premier digital healthcare distribution company, has sealed an exclusive partnership with CeraVe, a leading global skincare brand under the L’Oréal umbrella, to launch its product in the country. L’Oréal is the world leader in beauty: makeup, cosmetics, haircare and perfume in terms of quality, efficacy and safety.

Konga Health

Through Konga Health, a technology-driven healthcare solutions company focused on revolutionizing the healthcare value chain and a member of the Konga Group, this exclusive collaboration will debut with the renowned CeraVe line, offering unbeatable prices and free delivery to some locations Nationwide.

This enhanced partnership empowers Konga Health to onboard pharmacists, physicians, and other healthcare providers Nationwide to support the distribution of CeraVe’s product line. This initiative includes opportunities for recruitment, partnerships, and collaboration to ensure that high-quality skincare solutions are accessible to all nationwide.

This strategic alliance ensures that genuine CeraVe products reach Nigerian consumers swiftly and conveniently, leveraging Konga’s extensive e-commerce infrastructure. Concerns about counterfeit items that often plague the beauty and skincare market are now a thing of the past, as Konga becomes CeraVe’s official distributor in Nigeria.

CeraVe now boasts a dedicated official shop-in-shop (SIS) on Konga.com, serving as a one-stop destination for all authentic CeraVe products. Shoppers can directly access top-tier skincare solutions identical to those available globally.

Starting Monday, July 15th, CeraVe’s flagship products, such as the Cerave’s Hydrating Cleanser, Foaming Cleanser, SA Smoothing Cleanser, Fragrance-Free Moisturizer with 3 Essential Ceramides & Hyaluronic Acid, Barrier-Reinforcing Moisturizing Cream, Night Cream with Niacinamide, Exfoliating Salicylic Acid Foot Cream, Retinol Serum, Eye Repair Cream, Facial Moisturizers, Hyaluronic, and Vitamin C Serums, will be readily available on the Konga Health and Konga.com platforms, offering customers a seamless and convenient shopping experience.

Nnenna Emenyonu, Senior Vice President of Konga Health, expressed her excitement about the partnership, stating, “We are thrilled to partner with CeraVe, a brand synonymous with quality and scientific excellence in skincare. This collaboration allows our customers access to top-tier skincare products that are dermatologically tested and proven effective.”

Rabah Deroueche, LID LDB SSA and Business Development Director at L’Oreal, shared similar sentiments, noting, “Our partnership with Konga marks a significant milestone for CeraVe in Nigeria. By leveraging our commitment to quality skincare products and Konga’s platform, CeraVe can reach a wider audience and address the skincare needs of Nigerian consumers. This collaboration ensures Nigerian consumers can easily access our products and experience the benefits of our dermatologist-developed formulations.”

CeraVe has earned its stellar reputation globally through scientifically backed formulations. Developed in close collaboration with dermatologists, CeraVe products meet the highest standards of skincare and are celebrated for using essential ingredients that ensure optimal skin health.

The partnership between Konga and L’Oreal establishes Konga’s standing as a trusted e-commerce platform offering only high-quality products. As the official distributor of CeraVe, Konga is dedicated to maintaining the brand’s integrity by providing shoppers with authentic products that meet their skincare needs.


Kindly share this post
Continue Reading

E-Business

TD Africa Partners CISCO on Tech-Skills Development in Africa

Published

on

Kindly share this post

In its continuous drive to bridge the widening skills gap in Africa’s technology sector, TD Africa, Africa’s largest technology distribution company, has partnered with Cisco on its month-long inaugural training program.

TD-CISCO

The program, the first of its kind in the TD Academy training series, was aimed at empowering young minds with technical skills and professional exposure.

The initiative, titled “Introduction to Cisco Networking Solutions and Workplace Professional Skills,” exemplifies TD Africa’s comprehensive and futuristic approach to technology education and professional development, empowering individuals and businesses to thrive in the digital age.

This innovative series of pooled training aims to equip the participants with the foundational knowledge of Cisco networking solutions, which is critical for building and managing robust IT infrastructure and workplace professional skills, recognizing the importance of soft skills in today’s dynamic work environment.

This combined focus on technical competence and professional development aligns with TD Africa’s robust approach towards impacting appropriate skills set into young people.

Cisco’s extensive portfolio for this first leg of TD Academy encompasses carefully curated programs in cybersecurity, data analysis, and Artificial Intelligence (AI) to address the most sought-after skills in the African technology market.

For Mrs. Chioma Ekeh, CEO of TD Africa, the company’s dedication to bridging the skills gap is not a one-off training program nor limited to knowledge transfer.

Her words: “We understand the critical need for a skilled workforce to propel Africa’s digital transformation. Through our collaborative training programs with industry leaders like Cisco, we are committed to equipping individuals with the right tools and knowledge to succeed in this exciting field.”

Amblessed Ubong, one of the beneficiaries of the training program, said, “I recently completed a four-week training at the TD Academy; it was enriching and transformative.

“The sessions were thought-provoking, the trainers were passionate, and the environment was highly supportive. Collaborative projects enhanced my teamwork skills and made learning enjoyable.

“I left the TD Academy with a wealth of knowledge and a renewed enthusiasm for my career.”

Impressed by the exceptional talent emerging from the program, Africa’s number one tech distribution company immediately recruited some of the top graduates who participated in the training program.

This commitment to recognizing and nurturing talent further strengthens the technology ecosystem in Africa, creating a pipeline of skilled professionals for the future.

By empowering individuals and businesses with the necessary skills and knowledge, TD Africa is further stamping its foot in the sand of time, playing a pivotal role in Africa’s digital renaissance.


Kindly share this post
Continue Reading

E-Business

Davido Launches Chatter, Own Social Media App

Published

on

Kindly share this post

David Adeleke, Nigerian musician well known as Davido, has launched Chatter, a new social media application.

Davido Launches Chatter, Own Social Media App

Chatter is a social audiovisual utility platform designed to help amplify the voice of content creators and connect them with a vibrant community.

However, the app’s usage goes beyond content creators; business-minded individuals, as well as people looking to connect, have a place on it.

The musician used his social media accounts to announce the app’s release.

He gave a brief history of the development of the software and its features with his friend.

The well-known musician from Nigeria stated that he and Sir Banko, his close friend  are the owners of the app.

The music icon posted information about Chatter, a social audiovisual utility platform that connects content creators to a lively community and helps them magnify their voices.

In the past eight months, Davido has undertaken three internet projects.

Recall that the musician introduced his cryptocurrency.

However, the $DAVIDO coin fell a few days after it launched, prompting some cryptocurrency fans to call it a scam and a rug-pull.

 

 


Kindly share this post
Continue Reading

Trending