Network Security Breach Confirmed At Nvidia

Nvidia joined the seemingly unending parade of major corporations to fall victim of a hacking attack.  Recently, a group of hackers calling itself “Lapsus$” began sharing details about the incident and the damage that it caused. Nvidia confirmed the attack.

Nvidia released a formal statement which reads in part as follows:

“On February 23, 2022, NVIDIA became aware of a cybersecurity incident which impacted IT resources. Shortly after discovering the incident, we further hardened our network, engaged cybersecurity incident response experts, and notified law enforcement.

We have no evidence of ransomware being deployed on the NVIDIA environment or that this is related to the Russia-Ukraine conflict. However, we are aware that the threat actor took employee credentials and some NVIDIA proprietary information from our systems and has begun leaking it online.”

At this point there is no word about how many employee credentials were stolen. There is also no word on precisely what the proprietary information might have been. However, based on the official statement, it does not appear that any customer information was stolen.  Given that a hack occurred you should be careful. If you have an account with Nvidia, out of an abundance of caution it wouldn’t be a bad idea to change your password right away.

The corporate release goes on to say that the investigation into the matter is ongoing, so it is entirely possible that we will get additional details at some later date. Unfortunately, the year is still young and if history is a guide we’ll hear about dozens of other companies as the year grinds on who fall victim to hacking attacks of one sort or another.

Despite all the warnings and the money spent on internet security, lax password use and bad email habits remain the leading cause of corporate network breaches.  While we do not yet know how access to Nvidia was gained, odds are good that it was connected to one of those two.

Chip Makers Are Already Planning For WiFi7

We barely got to know Wi-Fi 6 but companies like Qualcomm are already making plans for the next generation of Wi-Fi technology. They are working on Wi-Fi 7 which is otherwise known as 802.11.

Granted, the new standard is a long way from being ready to roll out, so don’t expect to see any equipment on the market that’s capable of supporting it until late 2024 or early 2025.

Even so, the fact that companies are already developing and designing around draft releases of the new standard shouldn’t come as a surprise to anyone. Although we don’t have many details about Wi-Fi 7, we do know that it will be faster and increase bandwidth by a significant amount. We don’t have a firm handle on exactly what that means, though.

The best guess is that based on early drafts of the standard, the maximum nominal throughput of Wi-Fi 7 will be nearly five times faster than Wi-Fi 6 and marginally faster than a Thunderbolt ¾ connection.

Naturally, those are theoretical upper limits. So in the real world, once actual gear is in place, we won’t see anything quite so lofty.  Faster is faster though and based on what we know about latency improvements, we can expect it to be at least twice as fast as the current standard.

One of the most significant changes coming will be the fact that Wi-Fi 7 will transform routers into multi-link devices. So as far as your Xbox or smart speaker is concerned, they’re all the same thing.  That’s good news for end users because it will require a lot less in terms of configuration.  The router will simply pick the frequency with the lowest congestion and send data over that channel.

There are still many details to be ironed out. Between now and the ratification of the standard, there will undoubtedly be a whole host of changes in the months ahead but this is great news indeed.  We can hardly wait to see what the future holds.

Android Users Need To Watch Out For Teabot Trojan

If you have smart devices in the Android ecosystem, there’s a new threat to be aware of in the form of a malware strain called Teabot.  This bit of malicious code is a Remote Access Trojan or RAT for short. The group behind the code is making a big push to see it spread worldwide.

Researchers from Cleafy can confirm that the malware targets more than 400 different applications and the folk behind the code have begun to pivot away from their initial tactic of “smishing.”

Smishing, if you’re not familiar with the term, is a tactic used to compromise a mobile device via spam text messages that contain poisoned links.  If a recipient clicks on one of these links, they’re taken to a site controlled by the hackers and the malware is installed on the user’s computer in the background.

This bit of code emerged near the beginning of 2021. Back then, in its earliest incarnations it was known as Toddler/Anatsa.

In its primitive form, it was distributed exclusively via smishing and only had a list of sixty lures.  Granted they were big well-known lures like VLC Media player and DHL shipping but there were only sixty of them.

By July of last year, the owners of the malicious code had modified it to strike at dozens of banks based all over Europe. In the months that followed, at least 18 banks fell victim to Teabot attacks.

More recently, the malicious code has undergone additional changes. The malware has migrated from Europe spreading to Russia, the US, Hong Kong, and beyond.  In addition to that, it’s no longer targeting banks exclusively but cryptocurrency exchanges and digital insurance providers as well.  Even worse is that in at least one case Teabot has managed to infiltrate official Android repositories via dropper apps.

In terms of how big a problem this is, here is how it goes. Once Teabot is installed on a target system it can primarily log keystrokes and take screenshots. Then it can exfiltrate them to the malware’s controllers which means that in short order any site you log onto using your phone can quickly be compromised.

Stay vigilant out there.  It’s still early in the year and Teabot will certainly not be the last threat we face.

Scammers Cost Americans Billions Of Dollars In 2021

The US Federal Trade Commission reports that Americans lost almost six billion dollars to fraud last year.  The $5.8 billion total represented a catastrophic 70 percent increase compared to the losses reported in 2020.

The FTC maintains a database of millions of consumer records it uses to track such information. Based on the statistics gleaned from that database, US consumers filed 2,789,161 fraud reports during 2021. Roughly a quarter of those indicated a monetary loss.

A spokesman for the FTC had this to say about the data:

“Of the losses reported by consumers, more than $2.3 billion of losses reported last year were due to imposter scams–up from $1.2 billion in 2020, while online shopping accounted for about $392 million in reported losses from consumers–up from $246 million in 2020.

While younger people lost money 41 percent of the time they experienced fraud, older adults lost money only 17 percent of the time…but when older people did lose money, they lost a median amount of $1,500, or three times the median amount younger people lost.”

The scope and scale of this problem is simply staggering. Although it’s doubtful we’ll see another 70 percent increase this year the fact remains that US consumers are more at-risk now than ever before.

Odds are good that you’ve already had conversations about internet safety and security with your employees.  Most likely those conversations have centered around network security.  That’s completely understandable, but it pays to have additional conversations that focus on spotting and avoiding online scams.

One thing you can be sure of is that hackers and scammers will be ever watchful for opportunities to take advantage of the unsuspecting.  Don’t let your employees, coworkers, family, or friends be among their victims.  Stay vigilant out there.

Do your homework: 3 things to do when looking for an MSP

Do your homework: 3 things to do when looking for an MSP

Thinking of hiring a Managed Service Provider, but not sure how to go about it? Here are a few things to do before you zero in on one.

Figure out what you have already
The first step in a good plan is to figure out where you stand currently. Before you talk to an MSP, conduct an audit of your IT infrastructure to decide what you have currently. List all your hardware and software. When performing this IT audit, don’t forget other technologies that you are using, such as biometric access systems, CCTV systems and even telephone systems. You may think they are irrelevant as they are not directly related to your IT infrastructure, but, in the near future you may want them all to be connected to one another, and so, including them in the audit and inventory right now is a good idea.

Figure out what you need
This is the next step. After you determine what you already have, the next step is to figure out what you need. What do you want to add on or remove from your existing IT infrastructure? Are your servers too slow? Do you want to switch to the Cloud instead of traditional services? Do you want a Unified Communications set up instead of your current PBX phone line? Do you want to shift to a work-from-home model and need the infrastructure to support that?

Do your research
Now that you are clear about what you have and what you need, start doing your research. If you have an in-house IT team, you can ask them to evaluate the various options that can help you reach your goal. If not, then there are plenty of resources available online for SMBs that help with tech questions. https://www.sba.gov/learning-center is one great resource and a Google search will get you more.

As a part of this research, you should also make a list of credible MSPs in your area and learn more about them. A Google search can help you with that, but it would be even better if you reach out to a couple of your peers requesting them to refer you to their MSPs, if they have one.

Hiring an MSP means trusting them with your IT infrastructure, so it is very important that you have a clear understanding of what you really want and need, so you can share your expectations with your new MSP. This transparency and clarity goes a long way in determining the success or failure of your relationship with the MSP.