Connect with us

Happening

Zero-day flaw in Check Point VPNs is ‘extremely easy’ to exploit

Published

on

vpn backdoor-cybersecurity-flaw

Cybersecurity company Check Point says attackers are exploiting a zero-day vulnerability in its enterprise VPN products to break into the corporate networks of its customers. 

The technology maker hasn’t said yet who is responsible for the cyberattacks or how many of its customers are affected by intrusions linked to the vulnerability, which security researchers say is “extremely easy” to exploit.

In a blog post this week, Check Point said the vulnerability in its Quantum network security devices allows for a remote attacker to obtain sensitive credentials from an affected device, which can grant the attackers access to the victim’s wider network. Check Point said attackers began exploiting the bug around April 30. A zero day bug is when a vendor has no time to fix the bug before it is exploited.

The company urged customers to install patches to remediate the flaw.

Check Point has over 100,000 customers, according to its website. A spokesperson for Check Point did not return a request for comment asking how many of its customers are affected by the exploitation.

Advertisement

Check Point is the latest security company in recent months to disclose a security vulnerability in its security products, the very technologies that are designed to protect companies from cyberattacks and digital intrusions.

These network security devices sit on the edge of a company’s network and serve as digital gatekeepers for which users are allowed in, but have a tendency to contain security flaws that can in some cases easily skirt their security defenses and lead to compromise of the customer’s network.

Several other enterprise and security vendors, including Ivanti, ConnectWise, and Palo Alto Networks, have in recent months rushed to fix flaws in their enterprise-grade security products that malicious attackers have exploited to compromise customer networks to steal data. All of the bugs in question are high severity in nature, in large part due to how easy they were to exploit.

In the case of Check Point’s vulnerability, security research firm watchTowr Labs said in its analysis of the vulnerability that the bug was “extremely easy” to exploit once it had been located.

The bug, which watchTowr Labs described as a path-traversal vulnerability, means it’s possible for an attacker to remotely trick an affected Check Point device into returning files that should have been protected and off-limits, such as the passwords for accessing the root-level operating system of the device.

Advertisement

“This is much more powerful than the vendor advisory seems to imply,” said watchTowr Labs researcher Aliz Hammond.

U.S. cybersecurity agency CISA said it added the Check Point vulnerability to its public catalog of known-exploited vulnerabilities. In brief remarks, the government cyber agency said that the vulnerability in question is often used by malicious cyber actors, and that these kinds of flaws pose “significant risks to the federal enterprise.” Read more

vpn backdoor-cybersecurity-flaw
Continue Reading
Advertisement
Click to comment

Happening

Telegram CEO on Legal Challenges in France

Published

on

telegram ceo

❤️ Thanks everyone for your support and love!

Last month I got interviewed by police for 4 days after arriving in Paris. I was told I may be personally responsible for other people’s illegal use of Telegram, because the French authorities didn’t receive responses from Telegram.

This was surprising for several reasons: 

  1. Telegram has an official representative in the EU that accepts and replies to EU requests. Its email address has been publicly available for anyone in the EU who googles “Telegram EU address for law enforcement”. 
  2. The French authorities had numerous ways to reach me to request assistance. As a French citizen, I was a frequent guest at the French consulate in Dubai. A while ago, when asked, I personally helped them establish a hotline with Telegram to deal with the threat of terrorism in France.
  3. If a country is unhappy with an internet service, the established practice is to start a legal action against the service itself. Using laws from the pre-smartphone era to charge a CEO with crimes committed by third parties on the platform he manages is a misguided approach. Building technology is hard enough as it is. No innovator will ever build new tools if they know they can be personally held responsible for potential abuse of those tools. 

Establishing the right balance between privacy and security is not easy. You have to reconcile privacy laws with law enforcement requirements, and local laws with EU laws. You have to take into account technological limitations. As a platform, you want your processes to be consistent globally, while also ensuring they are not abused in countries with weak rule of law. We’ve been committed to engaging with regulators to find the right balance. Yes, we stand by our principles: our experience is shaped by our mission to protect our users in authoritarian regimes. But we’ve always been open to dialogue.

Sometimes we can’t agree with a country’s regulator on the right balance between privacy and security. In those cases, we are ready to leave that country. We’ve done it many times. When Russia demanded we hand over “encryption keys” to enable surveillance, we refused — and Telegram got banned in Russia. When Iran demanded we block channels of peaceful protesters, we refused — and Telegram got banned in Iran. We are prepared to leave markets that aren’t compatible with our principles, because we are not doing this for money. We are driven by the intention to bring good and defend the basic rights of people, particularly in places where these rights are violated.

All of that does not mean Telegram is perfect. Even the fact that authorities could be confused by where to send requests is something that we should improve. But the claims in some media that Telegram is some sort of anarchic paradise are absolutely untrue. We take down millions of harmful posts and channels every day. We publish daily transparency reports (like this or this ). We have direct hotlines with NGOs to process urgent moderation requests faster.

Advertisement

However, we hear voices saying that it’s not enough. Telegram’s abrupt increase in user count to 950M caused growing pains that made it easier for criminals to abuse our platform. That’s why I made it my personal goal to ensure we significantly improve things in this regard. We’ve already started that process internally, and I will share more details on our progress with you very soon. 

I hope that the events of August will result in making Telegram — and the social networking industry as a whole — safer and stronger. Thanks again for your love and memes 🙏. Credit source Pavel Durov via Telegram.

Continue Reading

Happening

What is crowd strike and why is everyone talking about it today

Published

on

Crowd Strike

CrowdStrike is a cybersecurity company, kind of like a digital knight in shining armor for businesses. They protect companies from cyberattacks and online threats.

Today, there’s a buzz around CrowdStrike because they’re dealing with a bit of a hiccup. One of their updates for Windows computers malfunctioned, causing some systems to act wonky. It’s important to note, however, that this wasn’t a cyberattack, more of a friendly fire situation. CrowdStrike is assuring everyone they’ve identified the problem, fixed it, and are patching things up as we speak.

Here’s a story for you:

It was a tense morning at DigiCorp, a tech startup. Alarms blared on laptops, throwing up error messages. Sarah, the head of IT, was fielding frantic calls from colleagues. Their data, their entire business, seemed to be on the fritz.

“Is it a ransomware attack?” someone shouted.

Advertisement

Sarah took a deep breath. “Let’s not panic. It could be anything. First, let’s isolate the problem and see if CrowdStrike can shed some light.”

Moments later, Sarah sighed with relief. CrowdStrike confirmed it wasn’t a malicious attack, but a glitch with their own update. A wave of laughter rippled through the stressed-out team.

“Well, that’s a relief,” Matt, a programmer, chuckled. “Though, maybe CrowdStrike needs to polish their knightly armor a bit.”

By lunchtime, CrowdStrike had rolled out a fix, and DigiCorp was back in business. Sarah sent a quick thank you note to their cybersecurity partners. Though it was a scare, it was a good reminder of how important CrowdStrike was in keeping their digital world safe.

Advertisement
Continue Reading

Happening

What are the disadvantages of YouTube monetization?

Published

on

YouTube has become a popular platform for content creators to share their work and potentially earn money. However, while monetization offers exciting opportunities, it also comes with its fair share of monetization challenges. In this article, we’ll explore the potential drawbacks of YouTube monetization and how they can impact creators.

Understanding YouTube Monetization Challenges

Before diving into the disadvantages, it’s essential to understand that YouTube monetization isn’t always a straightforward path to success. Many creators face various hurdles and obstacles that can affect their ability to earn revenue consistently.

The Pressure to Produce Consistently

One of the primary monetization challenges creators face is the constant pressure to produce content. To maintain a steady income, YouTubers often feel compelled to:

  1. Upload videos frequently
  2. Keep up with trends
  3. Constantly engage with their audience

This pressure can lead to burnout and may compromise the quality of content over time.

Dealing with Algorithm Changes

YouTube’s algorithm plays a crucial role in content discovery and monetization. However, frequent changes to this algorithm can present significant monetization challenges:

  • Videos may suddenly receive less exposure
  • Ad revenue can fluctuate unpredictably
  • Creators may need to adapt their content strategy frequently

Monetization Challenges: Advertiser-Friendly Content

To monetize videos effectively, creators must adhere to YouTube’s advertiser-friendly guidelines. This requirement can lead to several issues:

  1. Self-censorship
  2. Limited creative freedom
  3. Difficulty covering certain topics or niches

Some creators find these restrictions stifling and struggle to balance their artistic vision with monetization requirements.

The Unpredictability of Ad Revenue

Ad revenue, a primary source of income for many YouTubers, can be highly unpredictable. This volatility presents ongoing monetization challenges, including:

  • Seasonal fluctuations in ad rates
  • Changes in advertiser spending
  • Impact of global events on ad budgets

These factors can make it difficult for creators to plan their finances and rely on YouTube as a stable income source.

Navigating copyright laws on YouTube can be tricky. Creators face monetization challenges when:

Advertisement
  • Using copyrighted music or footage
  • Dealing with false copyright claims
  • Risking demonetization due to copyright strikes

These issues can result in loss of revenue and potentially affect a channel’s standing on the platform.

Competition and Market Saturation

As more people turn to YouTube for income, the platform becomes increasingly competitive. This saturation leads to monetization challenges such as:

  • Difficulty standing out in a crowded market
  • Lower ad rates due to increased supply of content
  • Pressure to create clickbait or sensational content

Creators may find it harder to grow their audience and maintain sustainable revenue streams in this environment.

Privacy and Personal Life Impacts

Successful YouTube monetization often requires creators to share aspects of their personal lives, which can lead to:

  • Loss of privacy
  • Online harassment or stalking
  • Difficulty separating work from personal life

These factors can take a toll on a creator’s mental health and overall well-being.

Dependence on a Single Platform

Relying solely on YouTube for income can be risky. Monetization challenges arise when:

  • YouTube changes its policies
  • Technical issues affect the platform
  • A creator’s account faces suspension or termination

Diversifying income sources becomes crucial to mitigate these risks.

Conclusion

While YouTube monetization offers exciting opportunities for content creators, it’s important to be aware of the potential drawbacks. From algorithm changes to privacy concerns, these monetization challenges can significantly impact a creator’s journey on the platform.

By understanding these challenges, aspiring YouTubers can better prepare themselves for the realities of content creation as a career. It’s crucial to approach YouTube monetization with a balanced perspective, weighing the potential rewards against the possible disadvantages.

Advertisement

Ultimately, success on YouTube requires not just great content, but also the ability to navigate these monetization challenges effectively. With the right strategy and mindset, creators can work towards building a sustainable and rewarding presence on the platform.

Continue Reading

Trending

Optimized by Optimole