Recently, a malware known as VPNFilter was discovered infecting various types of routers. VPNFilter is a modular, multi-stage malware that works mainly on home or small office routers. Since 2016, when the malware was initially introduced, it has compromised more than 500,000 home and small office routers and NAS boxes. Infection of such a large scale could allow the malware’s creators to utilize the affected nodes as a private VPN, making the trace back to the origin of a targeted attack very difficult. Though the infection vector is not yet clear, it is most likely to exploit known vulnerabilities affecting the various routers. There is no indication at present that the exploit of zero-day vulnerabilities is involved in spreading this threat. Some researchers and other US governmental bodies such as the FBI link this attack to the constant cat-and-mouse game between Russia and Ukraine. VPNFilter affected devices Devices infected by the VPNFilter malware include home and small office routers made by Linksys, MikroTik, Netgear and TP-Link, as well as network attached storage devices from QNAP. Magnitude of VPNFilter attack VPNFilter has been active since 2016, affecting some 500,000 devices in more than 54 countries. During May of 2018, two major attacks have been spotted targeting devices located in Ukraine. Threat behind VPNFilter The FBI hints to readers in its post that the VPNFilter malware attack could be the work of Sofacy Group, also referred as APT28, Sandworm, X Agent, Pawn Storm, Fancy Bear and Sednit. They have also seized a key domain that was used to infect home routers. It was also noted by Cisco researchers that the pattern of the attack indicates that the malware is part of a state-backed effort to create a versatile and effective botnet or data harvesting campaign, and shows the hallmarks of previous Eastern European malware efforts. Additionally, parts of this malware overlap code from the BlackEnergy malware which was responsible for multiple large-scale attacks that targeted devices in Ukraine, which was also attributed to a Russian government backed threat actor. VPNFilter infection process McAfee has provided a write-up on VPNFilter’s three-stage infection process: Stage 1 – completes the persistence on the system and uses multiple control mechanisms to find and connect the Stage 2 deployment server. Stage 2 – focuses on file collection, command execution, data extraction, and device management. Some versions possess a self-destruct capability to render itself unusable. Stage 3 – includes two known modules, possibly there are more to come: A traffic sniffer to steal website credentials and monitor Modbus SCADA protocols. Tor to communicate with anonymous addresses. How to prevent VPNFilter attack on the router Steps to protect against this malware are very generic and include the following: Reboot your device; if the device is infected with VPNFilter, rebooting will temporarily remove the destructive elements (outlined in stages 2 and 3 above). Perform a hard reset of the device, restoring factory settings to wipe it clean (removes elements from stage 1 above). Make sure you have the latest firmware installed. How Skybox Security can help defend your network Skybox Security can help identify vulnerability on a network quickly and provide recommendations for patching or other forms of mitigation – based on security controls such as firewalls and intrusion prevention systems (IPS). For this purpose, information about the vulnerability is analyzed in the Skybox Research Lab. A team of security analysts scours dozens of public and private safety data sources every day and investigates websites on the dark web. This allows Skybox to provide validated and up-to-date threat information. The Research Lab also provides vulnerability information regarding exploitability levels, exploitation preconditions and effects, and configures attack patterns to be used in Skybox’s patented attack simulations. By means of a vulnerability assessment without an active scan, the existence of vulnerability in a customer environment is to be derived. Vulnerabilities are then integrated into an attack surface model that includes the network topology, security controls and resources. The model performs attack simulations using information feed data to identify vulnerable assets directly or indirectly exposed to a potential attack. With Skybox, customers can quickly respond to threats such as theVPNFilter malware. Instead of focusing solely on the severity of the vulnerability, Skybox analyzes more factors than any other solution to determine the risk of attack. This can prevent an exploit like this from becoming a risk for companies. By Marina Kidron – Director, Threat Intelligence, Skybox Research Lab  

The Goods and Services Tax in India that is hailed as one of the most successful accomplishments of the current Government turned one year old on 30 June 2018.   The imposition of GST regime has echoed a mixed bearing on the service sector. On one hand, it is beneficial in various aspects such as one country one tax mode, seamless flow of credit, avoidance of multi-taxation etc., on the other it has produced snags in ease of doing business.  The Private Security Industry in particular, which is one of the largest employment generating industries in India making a workforce of over 7 million personnel is not going well along with the GST executions. They have shown utter disappointment with the regime and raised strong objections on the GST implementation.  Amongst others, the major impediment stems from the fact that GST is due to be deposited on the 20th day of every month while private security agencies receive payments for their respective services after 60 to 90 days; in the interim, however, they are mandated to meet the statutory compliances without fail. The gap between the business module of the private security industry and the imposed GST compliance regulations has created an unpleasant state of affairs for the industry. Central Association of Private Security Industry (CAPSI), the preeminent organisation for private security professionals in India have made several representations with the Government to amiably reach out to a rational reconciliation, but they could not fructify well. The CAPSI delegations knocked the doors of the Secretary, GST, CCI and MSME to suggest them to enable the system of reverse charge mechanism for security. Although the delegations at each stage were given a patient hearing, but no assurance towards the rectification of the anomaly has been suggested so far. The industry has decided not to give up and to proceed more pro-actively to counter the indifference. To begin with afresh, CAPSI has recently resolved to stage a nationwide peaceful protest (Dharna) on 18 July 2018 in front of GST offices of the respective states. The basic ethos of the protest is to simultaneously carry out multiple Dharna’s across the country with adequate media coverage in order to make the authorities aware about the seriousness of the issue. In this respect CAPSI State Chapter Presidents will sensitise all the security agencies in their states to participate whole heartedly in the protest. Along with CAPSI members, non-members of the industry are also requested to support the cause and participate in order to ensure adequate strength from the Industry. The participants will wear black T-shirts. CAPSI will also hold a press conference prior to the main event on 16 July at Press Club of India, which will coincide with the scheduled media conference at Delhi by CAPSI. The Dharna envisages an active involvement of APDI as well. APDI State Chapter Presidents are requested to garner the cooperation and indulgence of all the detective agencies operating in the states to actively participate in the Dharna and make it a huge success.  

The private security industry in India has gained a strong footing in the last decade. With the largest number of private security agents – estimated at 7 million – this industry provides employment to a huge section of people. Urbanisation, and introduction of government proposals such as Mission Smart Cities and Make in India have created a demand for more and more security personnel. Current state of affairs Private security industry plays a huge role in the safety of commoners. For a densely populated country like India, the police to people ratio is not significant enough, which has made the private security industry all the more popular. However, this industry grapples with many crises every day. One of the major problems is the lack of accountability from the security personnel. Security industry in India is largely unregulated, and it’s not uncommon to see guards swapping their shifts without intimating their employer. This impersonation can be potentially harmful, not just for the customer, but also for the security company This is just one of the many problems plaguing the security service providers. Unless there’s a scheduled visit or patrolling by a supervisor, there’s no way to monitor if the guards are alert on their job. Surprise visits to the premises are not a productive alternative either. The human body which is designed to retire at sunset starts to inevitably feel tired and dull during night shifts. Therefore, it makes sense to place your trust in systems, rather than a person to supervise the security personnel. How cloud telephony can help Automated Calls with IVR based check-in To check if the guards are alert, a simple mechanism such as an automated call can be set to trigger at particular time intervals. These calls can solicit input from the guards to ensure that they’re alert. Alternatively, they can be imparted with small training modules in vernacular that are a minute long, asked a related question towards the end of the module, and solicit a response from them. A lot has been said about the lack of training for the security guards. This is an interesting and engaging way to keep them alert and awake. Their call response is an attestation to their situational awareness and alertness. Actions can be initiated by the agency if they fail to respond or answer the call. This method is more proactive than reactive, and adheres to the urgency of the situation. Apart from these call check-ins that fall into a predictive pattern, surprise check-ins can be done by triggering calls at random times. This keeps the security officers alert and ensures they don’t nod off on duty. Automated check-in calls are a more sustainable solution, and the message or structure of the call can be changed every now and then to break the monotony, which is one of the major gripes of security officers. Reminder calls for shift changes Automated reminder calls can be set to go out an hour or 30 minutes prior to the shift, which ensures that the security officer is on time to relieve the on-duty officer. This reduces the chances of no-show or turning up late to the shift. SMS updates to the customer Since the shift rotation chart is prepared in advance, the details of security personnel on duty can be setup to be sent to the customer via an automated SMS message, which they can verify with the help of the personnel identification card. This ensures no impersonation can take place, thus assuring the safety of the customer. IVR to handle new/ potential customer queries For a security services provider, it is essential to be available at all times and put the customer’s safety interests first. Instead of employing a full-scale call center solution, IVR automation can be introduced to answer FAQs. This helps to optimize existing resources better, while also ensuring that an agent does not have to be on-call at all times. A technology like cloud telephony can bring responsibility to this unorganized sector. What’s more – it is not a stand-alone solution. A virtual number that is obtained from a cloud telephony service provider can help provide all the features mentioned above. By Shivakumar Ganesan – CEO & Co-founder of Exotel