Microsoft Bing team launches COVID-19 tracker

Microsoft's COVID-19 tracker is located at bing.com/covid.

 By Catalin Cimpanu for Zero Day | March 15,

The Microsoft Bing team launched today a web portal for tracking coronavirus (COVID-19) infections across the globe.

"Lots of Bing folks worked (from home) this past week to create a mapping and authoritative news resource for COVID19 info," said Michael Schechter, General Manager for Bing Growth and Distribution at Microsoft.

The website, accessible at bing.com/covid, is a basic tracker. It shows up-to-date infection statistics for each country around the globe and all the US states.

Data is aggregated from authoritative sources like the World Health Organization (WHO), the US Centers for Disease Control and Prevention (CDC), and the European Centre for Disease Prevention and Control (ECDC).

Users can click countries or US states on the map and see the latest infection stats, along with the latest COVID-19 news coverage for that specific country or state.

Microsoft announced the website tonight, two days after President Trump said Google began working on COVID-19-related portal for US citizens.

According to reports, Google's websites will be more than just an infection tracker and news portal, and will also include information on COVID-19 symptoms, risks associated with the disease, and info on local testing centers.


Google's website is being built by Verily, a subsidiary of Alphabet focused on healthcare services. More than 1,700 engineers are currently working on the site, President Trump said.

The COVID-19 outbreak, which started in late December 2019 in China, has now infected more than 168,000 people and killed nearly 6,500.

Earlier this week, the WHO officially declared COVID-19 a global pandemic. The last time when a global pandemic was declared was in 2009, for the H1N1 influenza virus.

List of Free Software and Services During Coronavirus Outbreak

List of Free Software and Services During Coronavirus Outbreak


By
Lawrence Abrams March 14, 2020 04:59 PM 0








In response to the Coronavirus (COVID-19) outbreak, many organizations are asking their employees to work remotely. This, though, brings new challenges to the workplace as users adapt to video meetings, screen sharing, and the use of remote collaboration tools.


To assist a new wave of remote works and get some publicity at the same time, many software developers and service providers have started to offer free licenses or enhanced versions of their software and services.


Below is a roundup of all the free upgrades to services and software licenses being offered during the Coronavirus outbreak.


If you are a software developer or technology service provider and would like to add any free offers to this list, please contact us and let us know.
AT&T


According to a report by Vice, AT&T is suspending broadband data caps during the Coronavirus outbreak.


AT&T is the first major ISP to confirm that it will be suspending all broadband usage caps as millions of Americans bunker down in a bid to slow the rate of COVID-19 expansion. Consumer groups and a coalition of Senators are now pressuring other ISPs to follow suit.
Cisco


Cisco is changing its free Webex meeting software so that it supports unlimited usage, supports up to 100 people per meeting, and has toll dial-in availability.


For businesses that are not currently a customer, Cisco is also offering free 90-day trials.


"Additionally, through our partners and the Cisco sales team, we are providing free 90-day licenses to businesses who are not Webex customers in this time of need. We’re also helping existing customers meet their rapidly changing needs as they enable a much larger number of remote workers by expanding their usage at no additional cost."
Cloudflare


Cloudflare has made its Cloudflare for Teams service free for small businesses for at least six months.


"Beginning today, we are making our Cloudflare for Teams products free to small businesses around the world. Teams enables remote workers to operate securely and easily. We will continue this policy for at least the next 6 months."


Using Cloudflare for Teams, remote workers can gain access to a company's internal resources using a secure VPN.
Discord


Discord has enhanced its free Go Live streaming service so that it can now support 50 simultaneous users rather than 10.


"We wanted to find a way to help, so we’re temporarily upping the limit on Go Live to 50 people at a time, up from 10. Go Live is free to use and lets people privately stream or screen share apps from a computer while others watch on any device — so teachers can conduct a class, co-workers can collaborate, and groups can still meet. You can learn more about how to get started with Go Live here," Discord stated in a blog post.
Google


Google is giving G Suite and G Suite for Education customers free access to their Hangouts Meet video-conferencing features.


This includes these features:
Larger meetings, for up to 250 participants per call
Live streaming for up to 100,000 viewers within a domain
The ability to record meetings and save them to Google Drive
Instant Housecall


Subscribers to Instant Housecall can now create subaccounts that allow remote workers to take over their office PC. This offer will be available until the World Health Organization (WHO) designates the end of the pandemic.


"All plans now include subaccounts that let your customers work remotely. Using a subaccount that you create, your customers can login and control their own unattended PC," the announcement states.
Logmein


LogMeIn is providing a free Emergency Remote Work Kit that gives free 3-month site-wide licenses to GoToMeeting to make it easier for remote workers to conduct meetings.


"Starting immediately, we will be offering our critical front-line service providers with free, organization-wide use of many LogMeIn products for 3 months through the availability of Emergency Remote Work Kits. These kits will include solutions for meetings and video conferencing, webinars and virtual events, IT support and management of remote employee devices and apps, as well as remote access to devices in multiple locations. For example, the “Meet” Emergency Remote Work Kit will provide eligible organizations with a free site-wide license of GoToMeeting for 3 months," LogMeIn CEO Bill Wagnar said in a blog post.
Loom


The Loom video messaging platform has announced that through July 1st, 2020 they will provide these additional features:
Remove the recording limit on our free plan — what was 25 is now unlimited
Cut the price of Loom Pro in half — what was $10/month is now $5/month
Extend all trials of Loom Pro from 14 to 30 days
Microsoft


Microsoft is making Microsoft Teams for free for the next six months to aid businesses who move towards a remote workplace during the outbreak.


"At Microsoft, the health and safety of employees, customers, partners and communities is our top priority. By making Teams available to all for free for six months, we hope that we can support public health and safety by making remote work even easier," Microsoft EVP and President JP Courtois stated on Twitter.
Splashtop


Splashtop is offering free 60-day licenses to its Business Access remote access software.


"In response to the recent coronavirus outbreak, many organizations, businesses, educational institutions, and governments are recommending that people work from home to help reduce the spread of the virus. To support these remote work initiatives, Splashtop is offering its Splashtop Business Access remote computer access software free for 60 days in some of the most affected countries.


Residents of China, Hong Kong, Macau, and Taiwan are eligible for the free license,"
TechSmith


TechSmith is giving free licenses to their TechSmith Snagit screen capture software and the TechSmith Video Review software through June 30th, 2020.


"Our screen recording tool, TechSmith Snagit, and our asynchronous collaboration platform, TechSmith Video Review, will be provided for free through the end of June 2020 to any organization that needs it," TechSmith announced.


For existing customers of the TechSmith Relay or Video Review products, TechSmith is providing free increased usage with no charge.
Zoho


Zoho is now offering free access to its Remotely remote work software suite through July 1st, 2020.


"Zoho Remotely will enable you to take your work remote by offering a complete suite of web and mobile apps that will help you communicate, collaborate and be productive."
Zoom


For people in China, Zoom has enhanced the Basic (free) license by removing the 40-minute meeting limit.


With this tenet in mind, Zoom is doing everything we can to provide resources and support to those navigating the coronavirus outbreak, including:
For our Basic (free) users in China, we’ve lifted the 40-minute limit on meetings with more than two participants, providing unlimited time to collaborate.
We’re proactively monitoring servers to ensure maximum reliability amid any capacity increases, as uptime is paramount.
We’re scheduling informational sessions and on-demand resources so anyone can learn how to use the Zoom platform with ease — and at their convenience.

Ψεύτικοι «χάρτες εξάπλωσης του κορωνοϊού» μολύνουν υπολογιστές

13 Μαρτίου, 2020, 12:38 μμ  by Absenta Mia   Leave a Comment




Η πανδημία του κορωνοϊού, έχει πλήξει τουλάχιστον 114 χώρες μέχρι σήμερα, μολύνοντας πάνω από 128.000 άτομα και στοιχίζοντας τη ζωή σε 4700 ανθρώπους. Οι κακόβουλοι παράγοντες ωστόσο, εκμεταλλεύονται αυτή την αναταραχή, δημιουργώντας ψεύτικους χάρτες εξάπλωσης του κορωνοϊού, ώστε να μολύνουν με malware τους υπολογιστές των χρηστών.

Καθώς η ανησυχία για τον κορωνοϊό μεγαλώνει, όλο και περισσότεροι αναζητούν online χάρτες ώστε να παρακολουθούν την εξάπλωση του ιού. Ωστόσο ορισμένοι από αυτούς τους χάρτες χρησιμοποιούνται από hacker, για να μολύνουν τα συστήματα των χρηστών και να κλέψουν προσωπικές πληροφορίες.

Μην κατεβάζετε χάρτες εξάπλωσης του κορωνοϊού

Παρόλη την κατάσταση που επικρατεί, πρέπει να αποφεύγετε να κατεβάζετε χάρτες που δείχνουν την εξάπλωση του ιού στη συσκευή σας. Σύμφωνα με έρευνα της Reason Security, αυτοί οι χάρτες, συχνά περιέχουν επικίνδυνα malware όπως το AZORult.

Χρησιμοποιώντας το AZORult, οι hackers μπορούν να κλέψουν το όνομα χρήστη, τους κωδικούς πρόσβασης, τους αριθμούς πιστωτικών καρτών, το ιστορικό του προγράμματος περιήγησης και τα διαπιστευτήρια σύνδεσης στα social media. Επίσης μπορούν να αποκτήσουν πρόσβαση στους τραπεζικούς λογαριασμούς, τα πορτοφόλια cryptocurrencies, ή ακόμα και να αποκτήσουν πλήρη απομακρυσμένη πρόσβαση στη μολυσμένη συσκευή σας.

Το Reason Labs ανακάλυψε ένα τέτοιο κακόβουλο λογισμικό, που ονομάζεται “Corona Virus Map” και χρησιμοποιεί την ίδια διεπαφή με τον tracker του Johns Hopkins University, ο οποίος είναι νόμιμος. Πρόκειται για ένα μικρό αρχείο EX32 Win32 που ονομάζεται Corona-virus-Map.com.exe. με μέγεθος payload περίπου 3,26 MB.

Επί του παρόντος, το κακόβουλο λογισμικό AZORult επηρεάζει μόνο τις συσκευές Windows. Ωστόσο, οι ερευνητές πιστεύουν ότι οι hackers θα μπορούσαν να δημιουργήσουν και μία έκδοση για άλλα λειτουργικά συστήματα.

Πώς θα καταλάβετε ένα ψεύτικο χάρτη


Σε αντίθεση με τους έγκυρους χάρτες, οι μολυσμένοι συχνά παροτρύνουν του χρήστες να κατεβάσουν μία άλλη εφαρμογή στη συσκευή τους για να βλέπουν ζωντανά την εξάπλωση του ιού.

Ένας άλλος τρόπος για τον εντοπισμό αυτών των ψεύτικων ιστότοπων είναι να ελέγξετε τη διεύθυνση URL ή τις λεπτομέρειες, καθώς διαφέρουν από τα νόμιμα dashboards του κορωνοϊού.

Εάν έχετε ήδη εγκαταστήσει το “Corona Virus Map” ή οποιονδήποτε τέτοιο πλαστό χάρτη, θα πρέπει να το απεγκαταστήσετε αμέσως και να κάνετε μία σάρωση για ιούς στη συσκευή σας. Αν τώρα έχετε κατεβάσει κάποιον άλλο χάρτη, πρέπει να σαρώσετε επίσης την συσκευή σας για παν ενδεχόμενο.

Ωστόσο υπάρχουν και ορισμένοι έγκυροι χάρτες που μπορείτε να εμπιστευτείτε για να παρακολουθείτε την εξάπλωση του κορωνοϊού:

Johns Hopkins’s

Healthmap.org

US Centers for Disease Control and Prevention

WHO’s official tracker

US Govt Shares Tips on Securing VPNs Used by Remote Workers

By Sergiu Gatlan  March 13, 2020  03:34 PM  0






The Department of Homeland Security's cybersecurity agency today shared tips on how to properly secure enterprise virtual private networks (VPNs) seeing that a lot of organizations have made working from home the default for their employees in response to the Coronavirus disease (COVID-19) pandemic.

"As organizations elect to implement telework, the Cybersecurity and Infrastructure Security Agency (CISA) encourages organizations to adopt a heightened state of cybersecurity," an alert published today says.
Malicious actors expected to focus attacks on teleworkers

Since more and more employees have switched to using their org's VPNs for teleworking, threat actors will increasingly focus their attacks on VPN security flaws that will be less likely to get patched in time if work schedules will be spread around the clock.

CISA also highlights the fact that malicious actors might also increase their phishing attacks to steal the user credentials of employees working from home, with orgs that haven't yet implemented multi-factor authentication (MFA) for remote access being the most exposed.


US-CERT
✔@USCERT_gov



Is your organization teleworking because of #COVID19? Here are some https://go.usa.gov/xdMYJ key recommendations on enterprise VPN security. #CyberVigilance #Cyber Cybersecurity #Infosec
102
9:12 PM - Mar 13, 2020
Twitter Ads info and privacy
105 people are talking about this



"Organizations may have a limited number of VPN connections, after which point no other employee can telework," CISA adds.

"With decreased availability, critical business operations may suffer, including IT security personnel’s ability to perform cybersecurity tasks."
Mitigations for boosting enterprise VPN security

Among the mitigation measures recommended for organizations considering telework options for their employees because of the Coronavirus disease (COVID-19) pandemic, CISA lists:


• Keeping VPNs, network infrastructure devices, and devices used for remote work up to date (apply the latest patches and security configs).
• Notifying employees of an expected increase in phishing attempts.
• Ensuring that IT security staff are ready for remote log review, attack detection, and incident response and recovery.
• Implementing MFA on all VPN connections or required employees to use strong passwords to defend against future attacks.
• Testing VPN infrastructure limitations in preparation for mass usage and take measures such as rate-limiting to prioritize users that will require higher bandwidths.

As part of its teleworking guidance, CISA also advises organizations to review DHS documentation on how to secure network infrastructure devices, avoid social engineering and phishing attacks, choose and protect passwords and supplement passwords, as well as the National Institute of Standards and Technology (NIST) guide to enterprise telework and BYOD security

The DHS cybersecurity agency previously warned orgs to patch Pulse Secure VPN servers against ongoing attacks trying to exploit a known remote code execution (RCE) vulnerability tracked as CVE-2019-11510.

One week later, the FBI said in a flash security alert that state-backed hackers have breached the networks of a US financial entity and a US municipal government after exploiting servers left vulnerable to CVE-2019-11510 exploits.


US-CERT
✔@USCERT_gov



Unpatched Pulse Secure VPN servers remain an attractive target for malicious actors. @CISAgov released an Alert on continued exploitation of CVE-2019-11510 in Pulse Secure. Update ASAP! https://go.usa.gov/xpSzQ #Cyber #Cybersecurity #InfoSec
255
6:17 PM - Jan 10, 2020
Twitter Ads info and privacy
218 people are talking about this



CISA also published information on how to defend against scammers who use the Coronavirus Disease 2019 (COVID-19) health crisis as bait to push their scams over the Internet.

The World Health Organization (WHO) and the U.S. Federal Trade Commission (FTC) issued warnings about ongoing Coronavirus-themed phishing attacks and scam campaigns in February.

Microsoft, Google, LogMeIn, and Cisco have also announced last week that they are offering free licenses for their meeting, collaboration, and remote work tools so that teleworkers can join virtual meetings and chat with colleagues while working remotely.

Related Articles:

US Govt Shares Tips to Defend Against Coronavirus Cyber Scams

US Govt Updates Info on North Korean Malware

US Govt Alerts Financial Services of Ongoing Dridex Malware Attacks

US Govt Warns of Ransomware Attacks on Pipeline Operations

US Charges Huawei With Conspiracy to Steal Trade Secrets, Racketeering

Rocket Loader skimmer impersonates CloudFlare library in clever scheme

Rocket Loader skimmer impersonates CloudFlare library in clever scheme

Posted: March 10, 2020 by Jérôme Segura
Last updated: March 11, 2020


Update: The digital certificate issued for https[.]ps has been revoked by GlobalSign.

Fraudsters are known for using social engineering tricks to dupe their victims, often times by impersonating authority figures to instill trust.

In a recent blog post, we noted how criminals behind Magecart skimmers mimicked content delivery networks in order to hide their payload. This time, we are looking at a far more clever scheme.

This latest skimmer is disguised as a JavaScript file that appears to be CloudFlare’s Rocket Loader, a library used to improve page load time. The attackers created an almost authentic replica by registering a specially crafted domain name.

This campaign has been affecting a number of e-commerce sites and shows threat actors will continue to come up with ingenious ways to deceive security analysts and website administrators alike.
Decoy Rocket Loader

On a compromised Magento site, we noticed that attackers had injected a script purporting to be the Rocket Loader library. In fact, we can see two almost identical versions loaded side by side.

If we look at their source code, we find that the two scripts are quite different. One of them is obfuscated, while the other is recognizable as the legitimate CloudFlare Rocket Loader library.

There is a subtle difference in the URI path loading both scripts. The malicious one uses a clever way to turn the domain name http.ps (note the dot ‘.’ , extra ‘p’ and double slash ‘//’) into something that looks like ‘https://’. The threat actors are taking advantage of the fact that since Google Chrome version 76, the “https” scheme (and special-case subdomain “www”) is no longer shown to users.

To reveal the full URL with its protocol, you can double click inside the address bar. In other browsers such as Firefox or Edge, the default is to show the entire URL. That makes this attack a little more obvious and therefore less effective if you were a site administrator investigating this library.
Active skimmer campaign

The Palestinian National Internet Naming Authority (PNINA) is the official domain registry for the .ps country code Top-Level-Domain (ccTLD). The decoy domain http.ps was registered on 2020-02-07 via the Key-Systems GmbH registrar.

In mid-February, security researcher Willem de Groot tweeted about how this domain was being used for credit card skimming in an ongoing campaign with the additional “e4[.]ms” domain.

The skimmer code as well as its exfiltration gate (autocapital[.]pw), were described by Denis Sinegubko, a security researcher at GoDaddy/Sucuri.

There are two ways e-commerce sites are being compromised:
Skimming code that is injected into a self hosted JavaScript library (the jQuery library seems to be the most targeted)
A script that references an external JavaScript, hosted on a malicious site

The first version of the skimmer used in this campaign is the hex obfuscated type with data exfiltration via autocapital[.]pw as seen in the decoy Rocket Loader library. As Denis mentioned in his tweet, this skimmer contains an English and Portuguese version (urlscan.io archive here).

The other version of the skimmer (hosted on e4[.]ms) uses a different obfuscation scheme with data exfiltration via xxx-club[.]pw (this domain is on the same server as the autocapital[.]pw exfiltration gate).

We recognize this obfuscation pattern as ‘Radix’, from a previous campaign described and tracked by Sucuri since 2016. Given the naming convention used for the domains and skimmers, we believe the same threat actors may be behind this newest wave of attacks.
Patching and proactive security

This kind of attack reinforces the importance of good website security. The majority of compromises happen on sites that have not been updated or that use weak login credentials. These days, other forms of defense include web application firewalls and general hardening of the CMS and its server.

The majority of consumers that shop on a compromised site will have no idea that something went wrong until it’s too late. Even though it is the responsibility of the merchant to ensure their platform is secure, it is obvious that additional containment needs to be taken by visitors themselves.

Malwarebytes users are protected against this credit card skimming attack via our web protection layer in Malwarebytes for consumers and businesses.

We have reached out to the registrar and certificate authority but at the time of writing the malicious decoy domain is still active.
Indicators of compromise

Skimmers and gateshttp[.]ps autocapital[.]pw xxx-club[.]pw e4[.]ms y5[.]ms
83.166.248[.]67
83.166.244[.]189