SANS Sees Phishers Use Tricky Hyphens in URLs

Posted on 20/02/2025 by Tim

To a phisher, one tiny hyphen can make a big mark.

SANS Technology Institute Dean of Research Johannes Ullrich alerted users to a “clever” phishing tactic that uses a URL containing a “com-” domain prefix. With that tiny, easy-to-miss hyphen, threat actors can disguise a malicious destination.

Ullrich noted on the SANS site that the phishing tactic was placed into fraudulent messages alerting a user of unpaid tolls. (The FBI warned the public of toll trolls in April 2024, when there were over 2,000 complaints of attacks using fake text messages.)

How the “.com-” tactic works. A legitimate site involving Florida’s toll system (SunPass) would involve a forward slash and look something like: “sunpass.com/tolls.”

In instances discovered by Ullrich and shared on the SANS site, the phisher registers for and receives a domain that begins with “com-,” followed by seemingly random letters, then ending with a top-level domain, like .info, .top, .xyz, and even .com.

To a reader, the phishy URL appears as something like: “sunpass.com-[random letters].top”—a tricky difference to notice when you’re quickly looking on a tiny phone screen and it appears that you owe toll money.

Fraud jobs. URL obfuscation is a favorite tactic of opportunistic threat actors, who register mimicking domains to trick fans of events like the Super Bowl or the Olympics. (Business administration company CSC identified 5,000 unique domain registrations mimicking well-known sportsbooks, between Jan. 1, 2023, and Dec. 24, 2024, for example.)

According to the FTC, government impersonation scammers led to $618 million in losses in 2023, up from $497 million in 2022 and $428 million in 2021.

Dash money. Ullrich told IT Brew that he continues to see “com-” domains registered: 315 on Feb. 11, 428 on Feb. 10, and 269 on Feb 9. (The sites are often short-lived and quickly shut down as fraudulent, he added.)

Many of the questionable domains point to the same IP address, Ullrich said, suggesting one actor is registering and rotating between them.

Ullrich also shared with IT Brew a new twist on the hyphen-ishing trend: A “com.-” domain prefix with a “.com” ending to the URL, and a “case number” in between to convince targeted users that the sender is from an IT support team.

“They can use any prefix for the domain to impersonate arbitrary .com domains,” Ullrich told us in an email.

In his Feb. 5 post, Ullrich advised IT pros to review DNS queries for these kinds of prefixes.

SOURCE ARTICLE:

https://www.itbrew.com/stories/2025/02/18/sans-sees-phishers-use-tricky-hyphens-in-urls?mbcid=38663986.101742&mblid=0526c530a3f5&mid=bfeacb7fd34941195bb37df6366acc6f&utm_campaign=itb&utm_medium=newsletter&utm_source=morning_brew

The Art of Linux Kernel Rootkits

Posted on 20/02/2025 by Tim

1. What is a rooktit?

A rootkit is malware whose main objective and purpose is to maintain persistence within a system, remain completely hidden, hide processes, hide directories, etc., in order to avoid detection.

This makes its detection very complex, and its mitigation even more complex, since one of the main objectives of a rootkit is to remain hidden.

A rootkit, it changes the system’s default behavior to what it wants.

1.1 What is a kernel? Userland and kernel land differences

The kernel is the core of the operating system, responsible for managing system resources and facilitating communication between hardware and software. It operates at the lowest layer of the system, for example components that operate in kernel land include the kernel itself, device drivers and kernel modules (which we call Loadable Kernel Module, short for LKM).

On the other hand, the userland or userspace is the layer where user programs and applications are executed. This is the part of the OS that interacts with the user, including browsers, text editors, games, common programs that the user uses, etc.

1.2 What is a system call?

System calls (syscalls) are fundamental in OS, they allow running processes to request services from the kernel

These services include operations such as file management, inter-process communication, process creation and management, among others.

A very practical example is when we write code in C, a simple hello world, if we analyze it with strace for example, you will notice that it uses sys_write to be able to write Hello world.

root@infect:~# cat hello.c ; ls hello
#include <stdio.h>

int main() {
    printf("Hello, World!\n");
    return 0;
}
hello
root@infect:~# strace ./hello 2>&1 | grep write

write(1, "Hello, World!\n", 14Hello, World!
root@infect:~#

Continue reading →

Palo Alto Networks Tags New Firewall Bug

Posted on 20/02/2025 by Tim

Palo Alto Networks warns that a file read vulnerability (CVE-2025-0111) is now being chained in attacks with two other flaws (CVE-2025-0108 with CVE-2024-9474) to breach PAN-OS firewalls in active attacks.

The vendor first disclosed the authentication bypass vulnerability tracked as CVE-2025-0108 on February 12, 2025, releasing patches to fix the vulnerability. That same day, Assetnote researchers published a proof-of-concept exploit demonstrating how CVE-2025-0108 and CVE-2024-9474 could be chained together to gain root privileges on unpatched PAN-OS firewalls.

A day later, network threat intel firm GreyNoise reported that threat actors had begun actively exploiting the flaws, with attempts coming from two IP addresses.

CVE-2024-9474 is a privilege escalation flaw in PAN-OS fixed in November 2024 that allows a PAN-OS administrator to execute commands on firewalls with root privileges. Palo Alto Networks warned at the disclosure that the vulnerability was exploited as a zero-day.

CVE-2025-0111 is a file read vulnerability in PAN-OS, allowing authenticated attackers with network access to the management web interface to read files that are readable by the “nobody” user.

The CVE-2025-0111 flaw was also fixed on February 12, 2025, but the vendor updated its bulletin today to warn that it is also now being used in an exploit chain with the other two vulnerabilities in active attacks.

“Palo Alto Networks has observed exploit attempts chaining CVE-2025-0108 with CVE-2024-9474 and CVE-2025-0111 on unpatched and unsecured PAN-OS web management interfaces,” reads the updated bulletin.

While Palo Alto Networks has not shared how the exploit chain is being abused, BleepingComputer has been told they could be chained together to download configuration files and other sensitive information.

Continue reading →

Apple Fixes Zero-Day Vulnerability – Update ASAP!

Posted on 17/02/2025 by Tim

Apple has released an emergency security update for a vulnerability which it says may have been exploited in an “extremely sophisticated attack against specific targeted individuals.”

The update is available for:

iOS 18.3.1 and iPadOS 18.3.1 – iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later
iPadOS 17.7.5 – iPad Pro 12.9-inch 2nd generation, iPad Pro 10.5-inch, and iPad 6th generation

If you use any of these then you should install updates as soon as you can. To check if you’re using the latest software version, go to Settings (or System Settings) > General > Software Update. It’s also worth turning on Automatic Updates if you haven’t already, which you can do on the same screen.

Technical details

The new-found zero-day vulnerability is tracked as CVE-2025-24200. When exploited, the vulnerability would allow an attacker to disable USB Restricted Mode on a locked device. The attack would require physical access to your device

The introduction of USB Restricted Mode feature came with iOS 11.4.1 in July 2018. The feature was designed to make it more difficult for attackers to unlock your iPhone. When USB Restricted Mode is active, your device’s Lightning port (where you plug in the charging cable) will only allow charging after the device has been locked for more than an hour. This means that if someone tries to connect your locked iPhone to a computer or other device to access its data, they won’t be able to do so unless they have your passcode.

To enhance data security, especially when traveling or in public places, it is recommended that you enable USB Restricted Mode in your device settings. If your iPhone, iPad or iPod Touch is running iOS 11.4.1 or later, USB Restricted Mode is automatically on by default, but if you want to check and enable USB Restricted Mode, this can be done by going to Settings > Face ID & Passcode or Touch ID & Passcode > (USB) Accessories and toggling off (grey) the (USB) Accessories option. Enabling this setting adds an extra layer of protection against unauthorized data access.

Please note: toggling the option to green turns this feature off.

Vulnerabilities like these typically target specific individuals as deployed by commercial spyware vendors like Pegasus and Paragon. This means the average user does not need to fear attacks as long as the details are not published. But once they are, other cybercriminals will try to copy them.

Source Article:

https://www.malwarebytes.com/blog/news/2025/02/apple-fixes-zero-day-vulnerability-used-in-extremely-sophisticated-attack?utm_source=iterable&utm_medium=email&utm_campaign=b2c_pro_oth_20250217_februaryweeklynewsletter_v3_173948923242&utm_content=Apple_fixes

Do You Like to Play Steam Games? BEWARE of Malware!

Posted on 17/02/2025 by Tim

The free-to-play game, PirateFi, infects users with malware that steals browser cookies, enabling the malware’s creator to hijack access to various online accounts.

Original story:
A hacker published a PC game on Steam to infect users with Windows-based malware.

The free-to-play game, PirateFi, was released on Thursday. Days later, Valve was spotted sending out a message to affected users, warning them about the threat to their computers.

“We strongly encourage you to run a full-system scan using an antivirus product that you trust or use regularly, and inspect your system for unexpected or newly installed software,” Steam said.

PirateFi was published as a beta. However, according to Steam forum posts, one user noticed something was off when their antivirus software prevented them from running the game, flagging it as carrying “Trojan.Win32.Lazzzy.gen.”

“The essence of the virus: When you launch the ‘game,’ the virus unpacks into /AppData/Temp/****/ and looks like Howard.exe,” the user wrote in Rusian. The malware then appears to steal browser cookies, enabling the malware’s creator to hijack access to various online accounts.

Another gamer who downloaded the title wrote on Tuesday: “Most of my stuff has either been hacked and passwords changed or being signed in using cookies that’ve been stolen!”

Continue to read the rest of the articule below…

Source Article:

https://www.pcmag.com/news/did-you-download-this-steam-game-sorry-its-windows-malware?utm_source=tldrinfosec

Understanding CVE-2025-1094: PostgreSQL Exploit Risks (US Treasury)

Posted on 17/02/2025 by Tim

A high-severity SQL injection bug in the PostgreSQL interactive tool was exploited alongside the zero-day used to break into the US Treasury in December, researchers say.

Rapid7’s principal security researcher, Stephen Fewer, disclosed CVE-2025-1094 (8.1) on Thursday, saying it was a key part of the exploit chain that also included the BeyondTrust zero-day (CVE-2024-12356).

In fact, CVE-2025-1094 was so important to the chain that the BeyondTrust attack couldn’t have been pulled off without it, we’re told.

“Rapid7 discovered that in every scenario we tested, a successful exploit for CVE-2024-12356 had to include exploitation of CVE-2025-1094 in order to achieve remote code execution,” said Fewer.

“While CVE-2024-12356 was patched by BeyondTrust in December 2024, and this patch successfully blocks exploitation of both CVE-2024-12356 and CVE-2025-1094, the patch did not address the root cause of CVE-2025-1094, which remained a zero-day until Rapid7 discovered and reported it to PostgreSQL.”

According to Rapid7’s director of vulnerability intelligence, Caitlin Condon, CVE-2025-1094 affects all versions of the PostgreSQL interactive tool, but, fortunately, it isn’t particularly simple to exploit. Given the complexity of the exploit pattern, Rapid7 doesn’t expect attacks to be carried out away from the BeyondTrust versions already known to be vulnerable.

She said via Mastodon: “But with the above said, it’s clear that the adversaries who perpetrated the December attack really knew the target technology, which is yet another example of a zero-day exploit trend Rapid7 started tracking in 2023.”

The vulnerability in the PostgreSQL interactive tool (psql) can lead to arbitrary code execution (ACE) and there is also a technique to exploit it independently from CVE-2024-12356. Rapid7 said BeyondTrust’s patch for its zero-day didn’t address the root cause of the psql bug, but it does prevent the two from being exploited together.

The psql vulnerability can be exploited because of an incorrect assumption that a SQL injection attack can’t be carried out when a malicious input is safely escaped via PostgreSQL’s string escaping routines, Fewer said.

Source Article:

https://www.theregister.com/2025/02/14/postgresql_bug_treasury/?utm_source=tldrinfosec

BACK AT IT AGAIN AND ON A NEW JOURNEY!!

Posted on 05/02/2025 by Tim

It has been several years since I was actively posting on this site. The last three or so years I stepped away from hands-on keyboard type of work and staying up-to-date on IT related information. I was focused on creating a quarterly enablement plan for all VMware Field Sales/Technical folks had the latest information related to VMware solutions. I did this on a global scale working with all the Program Managers of our solutions as well as the field sales managers ensuring field personnel were getting the proper ongoing enablement.

VMware was acquired a little over a year ago by Broadcom. As usual with acquisitions, positions get eliminated as mine did. So I am back looking for a new opportunity and have decided I want to get into Cyber Security and use my years of experience in IT and technology to support this new venture.

I had my CompTIA Security+ in the past but has expired so I am working on that now to re-certify and help with breaking into the security side of the house. After I finish that I will be doing the Certified Information Systems Professional (CISSP) and Certified Ethical Hacker (CEH) certifications over the next few months.

My hope is with these security focused certifications under my belt, I can break into a Cyber Security role. I know I will have to get an entry-level position, but I am willing to do what it takes.

Needless to say, my posts moving forward will be security focused to support my new career. I plan to post relevant security information related to IT. Hopefully as I learn, my readers will learn as well!

I also would love to hear from any of you in the industry with any suggestions as far as what to post here as well as for myself in my Cyber Security learning journey.

NOW LET THE FUN BEGIN!!

Protecting Against Ransomware with Cohesity

Posted on 13/08/2020 by Tim

Protecting Against Ransomware with Cohesity:

As most of you are aware, 2020 has been especially riddled with Ransomware attacks against large corporations. However, large corporations are not the only ones under attack. These attacks are against all types of businesses from the largest corporations all the way down to the small mom and pop businesses. Government agencies to include federal, state, and local are under constant attack as well.

The most notable ransomware attacks that most have heard about include Garmin, Travelex, University of California San Francisco, Honda, and Canon USA. Click on the appropriate company name to go to an article specific to that companies attack.

NOTE: For 2021 statistics on Ransomware attacks, see the first link at the bottom of this blog called “Ransomware Statistics“.

Most of the data protection solutions on the market (especially the legacy solutions) today have fallen pray to the above list of recent Ransomware attacks as well as many others.

To this day, not one Cohesity customer has had a successful ransomware attack to where they gained access to their Cohesity backups to delete or encrypt them and where they have followed our security hardening guidelines. That means that our customers have been able to detect, prevent, and/or recover and not have to pay any ransom whatsoever.

Here is an example of what can happen in your typical ransomware attack of today:

Employee clicks on link in an email and hackers gain access to your network.
Hacker then installs a key logger and gets an administrators credentials to systems (including your data protection system) on the network.
- Hackers delete your backups of systems to ensure you can’t recover from backups and have to pay them the ransom.
If they don’t get administrator credentials to backup solution, they encrypt the backs first to again make sure you can’t recover any systems from backups and force you to pay the ransom.
If the company has any CCPA, GDPR, or other compliance related requirements and associated data, they collect that data.
They then encrypt the systems on the network.
Hackers notify the company that they have encrypted their systems and tell them they must pay a ransom to get the encryption keys to decrypt their systems. If they obtained any compliance related data, they also tell the company that they will publicly post the private data. If they do that, the company by law then has to publicly announce that they had a data breach. They then can be fined a very large amount of money for breaking compliance itself. This is a separate cost from the ransom.
Hackers typically give the company a certain time frame to pay the ransom or lose everything after that date as well as post any compliance related information on the internet.
If the company pays the ransom, it typically requires payment in Bitcoin because it is private and untraceable. Most companies don’t have a Bitcoin account, so they will need to pay a 3rd party company to convert the payment to Bitcoin in which the hackers will accept.
Once the ransom is paid, the hackers will provide all the decryption keys for every system that was encrypted.
The customer then has to randomly associate each decryption key to each server which can take days to do. The hackers don’t tell them which key goes to what specific server. If you have thousands of servers, that is a painfully long process all while your IT systems are still down.
Each virtual machine has to have twice the size of space on it in order to decrypt the system. Otherwise if there is not enough room on drive, decryption will fail until additional drive space is added. The time to go through this process can be painfully long based on how many systems need to be configured with additional storage.
At this point, this entire process from start to finish could be from days to weeks or more for a company to fully recover IF they pay the ransom.

For the company that has been attacked, if they have to pay the ransom due to being unable to restore from backups, this could mean a huge revenue loss for the company long term.

There are numerous costs associated to the attack:

The ransom itself.
The cost for 3rd party company to convert payment to Bitcoin.
Potential fines for breaking compliance due to leaked data if ransom not paid.
The associated cost of lost revenue due to systems being down for days, weeks, or more due to attack and recovery time frame of IT internal and externally facing services.
The associated cost of lost revenue due to bad reputation after personal data leaked.
The associated cost of massive increased hours worked by IT staff and any other employees to recover systems until they are back to normal operations.
Cost of new hardware/software implementation and associated man hours to implement new security measure to keep from being attacked again.
Legal actions against company for personal data leaked and other various reasons.
NEW (10/5/20) – US Department of the Treasury’s Office fines!

There are numerous precautions that can be taken to minimize the risk of your organization being attacked as well as recover easily and quickly to get your IT services up and running again. With that, securing your data protection (backup) solution becomes critical to protecting yourself against ransomware attacks.

How Cohesity Protects You Against Ransomware:

Cohesity takes security very serious and has extensive integrated cybersecurity in our solution. Listed below are the ways in which we protect your backups in our platform with the below principles and capabilities.

Reduce Attack Surface –
- Zero trust architecture.
- Bank-grade encryption (FIPS 140-2, NIST certified).
- Single global platform.
- No Windows or Linux front-end server.
Assess Security Posture & Vulnerabilities –
- Vulnerability Management:
  - CyberScan App – Uncover cyber exposures and blind spots within your production environment by running on-demand and automated scans on backup snapshots against known vulnerabilities.
- Advanced Threat Detection:
  - SentinalOne App – AI-powered prevention engine to Cohesity storage clusters, delivering the highest efficacy, lowest false positives, and most performant prevention technology. 100% signature-free and relies on machine learning models to deliver next-generation prevention.
- ClamAV App – Scan the files stored in the Cohesity DataPlatform directly, without sending the files to an external scanner.
- Configuration analysis.
- Marketplace (Apps): https://marketplace.cohesity.com/
Access Management & Auditing –
- Web UI, CLI, REST API’s all use SSL with TLS 1.2 and above.
- Self-signed X509 certificates or company CA/certificates can be used.
- Microsoft Active Directory integration and (RBAC) Role-Based Access Control.
- (2FA) Two Factor Authentication (CAC / SAML).
- (SSO) Single Sign-On Integration with SAML-based standards:
  - Active Directory
  - LDAP
  - Azure Active Directory
  - Okta
  - Ping
  - Duo
  - Shibboleth
- Operational & file level accounting.
- System & product level auditing.
- Exportable granular audit logs.
- Send logs to external syslog server.
- Global whitelists network segments, individual IP’s, etc.
Data Governance / Compliance –
- SEC 17a-f (f)
  - (WORM) Write Once Read Many & Data Security
- FIPS 140-2 level 1
- PCI DSS
- Common Criteria EAL2+
- Secure Government Clouds
  - AWS Govcloud
  - Azure Govcloud
  - C2S
- (TAA) Trade Agreements Act
- (ATO) Authority to Operate
- GDPR / CCPA Governance –
  - Global actionable search.
  - We reduced copies of data on average from 8-10 copies to potentially 1-2 copies.
Defend –
- Immutable file system –
  - Inaccessible from outside Cohesity cluster
  - Back ups stored in Read-Only state
- DataLock / (WORM) Write-Once-Read-Many –
  - Unable to delete/modify snapshots until the set retention time has passed
- LegalHold –
  - Unable to delete snapshots until LegalHold removed only by Data Security role
- Provides a virtual “air gap”
Detect –
- Helios machine learning driven anomaly detection.
  - Daily change rate on Logical data.
  - Daily change rate on stored data.
  - Pattern based on historical data ingest.
Respond –
- Google-like global actionable search.
- Instant mass restore – Recover hundreds or more virtual machines and have services up and running in the matter of minutes.
- Salable file system to store years worth of backup copies.

Additional Resources – Cohesity & Ransomware Protection:

Ransomware Statistics:
- https://www.comparitech.com/antivirus/ransomware-statistics/
Counter Ransomware Attacks with Cohesity (Whitepaper):
- https://www.cohesity.com/resource-assets/solution-brief/Counter-Ransomware-Attacks-with-Cohesity.pdf
Comprehensive Anti-Ransomware Solution: Prevent, Detect and Respond (Video):
- https://www.youtube.com/watch?v=WnR4n4e_FaY
Guarding Against Ransomware Requires More Than Just Detection (Blog):
- https://www.cohesity.com/blog/guarding-against-ransomware-requires-more-than-just-detection/
Cohesity Public Site – Ransomware:
- https://www.cohesity.com/solution/ransomware-recovery/
Cohesity Technical Guides: https://docs.cohesity.com/HomePage/Content/TechGuides/TechnicalGuides.htm
Cohesity Documents – Ransomware:
- https://docs.cohesity.com/WebHelios/Content/Helios/RansomewareAlert.htm
Cohesity’s Solutions for Air-gap Data Protection (Whitepaper):
- https://info.cohesity.com/air-gap-data-protection-with-cohesity-dataplatform-wp.html
CyberScan App (Video):
- https://www.youtube.com/watch?v=R1upyfXRtbQ
CyberScan App (Blog):
- https://www.cohesity.com/blog/new-app-uses-backup-data-to-combat-cyber-threats/
(CCPA) California Consumer Privacy Act:
- https://oag.ca.gov/privacy/ccpa
Streamlining GDPR Compliance (Solution Brief):
- https://www.cohesity.com/resource-assets/solution-brief/Cohesity_GDPR-Solution-Brief.pdf
Cohesity DataPlatform Security Whitepaper:
- https://docs.cohesity.com/HomePage/PDFs/Cohesity-White-Paper-Security-DataPlatform.pdf

Attending VMworld And Interested In vSphere 6.5 Security? Try My “vSphere 6.5 Security – Getting Started” Lab!

Posted on 04/08/2017 by Tim

Attending VMworld And Interested In vSphere 6.5 Security?

Try My “vSphere 6.5 Security – Getting Started” Lab!

If you are attending VMworld US 2017 from August 27-31st in Las Vegas, NV and you are interested in the new vSphere 6.5 Security feature sets, then I have a lab for you! I am a lab captain for the Hands On Labs and have two labs that I created for this years VMworld sessions.

These new labs as well as the many other will only be available at the VMworld US and Europe conferences initially. After both conferences are over, we slowly release most of the new labs to the public-facing Hands On Labs environment that anyone can get to with an internet connection. You will see some labs to start showing up on the public side right after VMworld and then the rest typically will be released within or month or so. No guarantee on what labs will make it to the public site and when they will show up though, that is just what I’ve typically seen over the past few years.

This is my first time as a lab captain and creating labs, so I would love to see some HUGE numbers of people taking my labs! It would make me feel good knowing that people learned something by taking my labs. If you end up taking either lab at VMworld or even after they have been released to the public-facing HOL site, let me know what you think! You can reach out to me on my social media outlets, the links to them are on the right side of the page.

Public Facing – Hands On Labs Site: labs.hol.vmware.com

Below are the labs that I have built and a summary of each of them:

(HOL-1811-01-SDC) vSphere 6.5 – What’s New:
- Description: Explore some of the new features of vSphere 6.5 including VM Encryption, vCenter High Availability, and the new HTML5 vSphere Client. You will also learn about the improved vCenter Server Appliance and how to migrate from a Windows-based vCenter Server installation.
(HOL-1811-04-SDC) vSphere 6.5 Security – Getting Started:
- Description: Experience new security features of vSphere 6.5, including VM Encryption, Audit Quality Logging, Encrypted vMotion, Key. We also use our vRealize Log Insight solution to look at the enhanced logging of the vCenter server logs. Add Key Management Servers (KMS) to the vCenter server and create a trust between them. Then we use PowerCLI commands to encrypt/decrypt virtual machines as well as other encryption related tasks.

Don’t forget to stop into the Hands On Labs at VMworld and take some labs…see you there!

Missed The Latest VMware Announcements In The Past Month? Check Out This Summary!

Posted on 19/05/2017 by Tim

Missed The Latest VMware Announcements In The Past Month?

Check Out This Summary!

Have you been busy lately and haven’t keep up to date with the latest VMware announcements over the last month or two? If so, you have missed quite a bit! So I thought I would make it easy on you and pull together all the recent announcements related to product updates, acquisitions, promotions, partnerships, VMworld, Wanna Cry Ransomeware, etc. This summary has a lot of great information that you want to be aware. I highly recommend that you read through the full list of announcements to be sure you are aware of them.

One link I would like to draw your attention to specifically is under “Security” which takes you to a VMware blog about the “WannaCry Ransomeware” attack that swept the world on May 12th, 2017 in over 150+ countries worldwide. The article discusses how VMware’s NSX solution and its “Zero Trust” model could have helped those that were attacked mitigate this attack. This just proves how important it is that businesses consider using VMware’s NSX solution to help protect their environments from attacks in ways that other solutions can’t.

Product Announcements:

vRealize Automation (vRA) 7.3 –
- Release Notes: http://pubs.vmware.com/Release_Notes/en/vra/73/vrealize-automation-73-release-notes.html?src=vmw_so_vex_akjaer_1025
- Documentation: https://www.vmware.com/support/pubs/vrealize-automation-pubs.html
User Environment Manager (UEM) 9.2 –
- Release Notes: https://pubs.vmware.com/Release_Notes/en/uem/9.2/uem-92-release-notes.html?src=vmw_so_vex_akjaer_1025
- Documentation: https://www.vmware.com/support/pubs/uem-pubs.html
VMware IoT Solutions Website –
- Website – http://www.vmware.com/products/pulse.html
- Blog – https://blogs.vmware.com/partner/2017/05/pulse-iot-center.html
Horizon Cloud (UPDATE) – Intent to deliver Horizon Cloud to Microsoft’s Azure cloud-based environment for the first time
- Blog – https://blogs.vmware.com/euc/2017/05/horizon-cloud-microsoft-azure.html

Acquisitions:

OVH Acquisition of vCloud Air Closed on 5/8/17 –
- News Release – http://www.vmware.com/company/news/releases/vmw-newsfeed.OVH-Announces-Intent-to-Acquire-VMware-vCloud-Air-Business.2153983.html
- Because of this, all Hands-On-Labs (HOL) labs related to vCloud Air labs have been removed from Partner University and the public facing Hands On Labs (HOL) site.
Apteligent (Analytics for the Digital Workspace) – https://blogs.vmware.com/euc/2017/05/vmware-acquires-apteligent-app-performance-digital-workspace.html
Wavefront (Cross-Cloud Capability) – https://blogs.vmware.com/management/2017/04/vmware-acquires-wavefront.html

Latest Promotions/Discounts: http://www.vmware.com/promotions.html

New Promotion – User Environment Manager (UEM) 9.2
Updated Promotion- vRealize 25% Upgrade Promotions Extended to July 29, 2017

Security:

WannaCry Ransomware attack that attacks Microsoft operating systems swept the world on May 12th in over 150+ countries. Below is VMware’s response on how the NSX Zero-Trust model could have helped mitigate this attack using NSX. This is a great opportunity for you to drive how critical it is to use NSX and where other solutions couldn’t provide the same protection that we can from these types of attacks.
- Blog: https://blogs.vmware.com/networkvirtualization/2017/05/use-zero-trust-protects-against-wannacry.html/

VMware Partnerships:

VMware and Pivotal Extend Strategic Alliance to Integrate NNSX and Pivotal Cloud Foundry –
- News Release – http://www.vmware.com/company/news/releases/vmw-newsfeed.VMware-and-Pivotal-Extend-Strategic-Alliance-to-Integrate-VMware-NSX-and-Pivotal-Cloud-Foundry-to-Deliver-New-Developer-Ready-Infrastructure.2163618.html
VMware Introduces Integrations with Dell EMC to Accelerate Workforce Transformation –
- News Release – http://www.vmware.com/company/news/releases/vmw-newsfeed.VMware-Introduces-Integrations-with-Dell-EMC-to-Accelerate-Workforce-Transformation.2163617.html
VMware & Google Announce Expanded Chromebook Partnership –
- News Release – https://www.vmware.com/radius/dell-emc-2017-chromebook/

VMware Partner Accreditation’s:

NEW VSP/VTSP- Server Virtualization Competencies –
- Server Virtualization Internal Presentation
- Server Virtualization External FAQ
NEW VSP/VTSP-Desktop competencies –
- Desktop Virtualization External FAQ
- Desktop Virtualization External Presentation

VMworld 2017:

VMworld US: Training & Certification Programs/Discounts – https://mylearn.vmware.com/mgrReg/plan.cfm?plan=100528&ui=www_edu

7 Simple Ways to Secure Your Smartphone

Posted on 22/03/2017 by Tim

7 Simple Ways to Secure Your Smartphone [blogs.air-watch.com]

7 Simple Ways to Secure Your Smartphone

As we move more of our work and personal lives digital and carry all of it in our pockets, securing our smartphones often feels daunting and confusing. If you follow a few simple steps, you can protect yourself from the vast majority of threats that exist—both physical and digital.

Share this:

Like this:

1. What is a rooktit?

1.1 What is a kernel? Userland and kernel land differences

1.2 What is a system call?

Share this:

Like this:

Share this:

Like this:

Technical details

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Protecting Against Ransomware with Cohesity:

Here is an example of what can happen in your typical ransomware attack of today:

There are numerous costs associated to the attack:

How Cohesity Protects You Against Ransomware:

Additional Resources – Cohesity & Ransomware Protection:

Share this:

Like this:

Attending VMworld And Interested In vSphere 6.5 Security?

Try My “vSphere 6.5 Security – Getting Started” Lab!

Don’t forget to stop into the Hands On Labs at VMworld and take some labs…see you there!

Share this:

Like this:

Missed The Latest VMware Announcements In The Past Month?

Check Out This Summary!

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

The difference Between VM Encryption in vSphere 6.5

and vSAN 6.5 Encryption (Yellow-Bricks)

Continue Reading Blog… Click Here!

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this: