Connect with us

Biz & IT

Android developers can now force app updates

Published

on

Half a year ago, at the Android Dev Summit, Google announced a new way for developers to force their users to update their apps when they launch new features or important bug fixes. It’s only now, at Google I/O, though, that the company is actually making this feature available to developers. Previously, it was only available to a few select Google partners.

In addition, Google is launching its dynamics updates feature out of beta. This allows developers to deliver some of their apps’ modules on demand, reducing the file size for the initial install.

“Right now, if you have an update, either you have auto-update or you need to go to the Play Store to even know that there is an update, or maybe the Play Store will give you a notification,” Chet Haase, chief advocate for Android, said. “But what if you have a really critical feature that you want people to get or, let’s say, a security issue you want to address, or a payment issue and you really want all of your users to get that as quickly as they can.”

This new feature, called Inline Updates, gives developers access to a new API that they can then use to force users to update. Developers can force users to update, say with a full-screen blocking message, force-install the update in the background and restart the app when the download has completed or create their own custom update flows.

Source link

Source link

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Biz & IT

Pipeline attacker Darkside suddenly goes dark—here’s what we know

Published

on

Darkside—the ransomware group that disrupted gasoline distribution across a wide swath of the US this week—has gone dark, leaving it unclear if the group is ceasing, suspending, or altering its operations or is simply orchestrating an exit scam.

On Thursday, all eight of the dark web sites Darkside used to communicate with the public went down, and they remain down as of publication time. Overnight, a post attributed to Darkside claimed, without providing any evidence, that the group’s website and content distribution infrastructure had been seized by law enforcement, along with the cryptocurrency it had received from victims.

The dog ate our funds

“At the moment, these servers cannot be accessed via SSH, and the hosting panels have been blocked,” the post stated, according to a translation of the Russian-language post published Friday by security firm Intel471. “The hosting support service doesn’t provide any information except ‘at the request of law enforcement authorities.’ In addition, a couple of hours after the seizure, funds from the payment server (belonging to us and our clients) were withdrawn to an unknown account.”

If true, the seizures would represent a big coup for law enforcement. According to newly released figures from cryptocurrency tracking firm Chainalysis, Darkside netted at least $60 million in its first seven months, with $46 million of it coming in the first three months of this year.

Identifying a Tor hidden service would also be a huge score, since it likely would mean that either the group made a major configuration error in setting the service up or law enforcement knows of a serious vulnerability in the way the dark web works. (Intel471 analysts say that some of Darkside’s infrastructure is public-facing—meaning the regular Internet—so malware can connect to it.)

But so far, there’s no evidence to publicly corroborate these extraordinary claims. Typically, when law enforcement from the US and Western European countries seize a website, they post a notice on the site’s front page that discloses the seizure. Below is an example of what people saw after trying to visit the site for the Netwalker group after the site was taken down:

So far, none of the Darkside sites display such a notice. Instead, most of them time out or show blank screens.

What’s even more doubtful is the claim that the group’s considerable cryptocurrency holdings have been taken. People who are experienced in using digital currency know not to store it in “hot wallets,” which are digital vaults connected to the Internet. Because hot wallets contain the private keys needed to transfer funds to new accounts, they’re vulnerable to hacks and the types of seizures claimed in the post.

For law enforcement to confiscate the digital currency, Darkside operators likely would have had to store it in a hot wallet, and the currency exchange used by Darkside would have had to cooperate with the law enforcement agency or been hacked.

It’s also feasible that close tracking by an organization like Chainalysis identified wallets that received funds from Darkside, and law enforcement subsequently confiscated the holdings. Such analyses take time, however.

Nonsense, hype, and noise.

Darkside’s post came as a prominent criminal underground forum called XSS announced that it was banning all ransomware activities, a major about-face from the past. The site was previously a significant resource for the ransomware groups REvil, Babuk, Darkside, LockBit, and Nefilim to recruit affiliates, who use the malware to infect victims and in exchange share a cut of the revenue generated. A few hours later, all Darkside posts made to XSS had come down.

In a Friday morning post, security firm Flashpoint wrote:

According to the administrator of XSS, the decision is partially based on ideological differences between the forum and ransomware operators. Furthermore, the media attention from high-profile incidents has resulted in a “critical mass of nonsense, hype, and noise.” The XSS statement offers some reasons for its decision, particularly that ransomware collectives and their accompanying attacks are generating “too much PR” and heightening the geopolitical and law enforcement risks to a “hazard[ous] level.”

The admin of XSS also claimed that when “Peskov [the Press Secretary for the President of Russia, Vladimir Putin] is forced to make excuses in front of our overseas ‘friends’—this is a bit too much.” They hyperlinked an article on the Russian News website Kommersant entitled “Russia has nothing to do with hacking attacks on a pipeline in the United States” as the basis for these claims.

Within hours, two other underground forums—Exploit and Raid Forums—had also banned ransomware-related posts, according to images circulating on Twitter.

REvil, meanwhile, said it was banning the use of its software against health care, educational, and governmental organizations, The Record reported.

Ransomware at a crossroads

The moves by XSS and REvil pose a major short-term disruption of the ransomware ecosystem since they remove a key recruiting tool and source of revenue. Long-term effects are less clear.

“In the long run, it’s hard to believe the ransomware ecosystem will completely fade out, given that operators are financially motivated and the schemes employed have been effective,” Intel471 analysts said in an email. They said it was more likely that ransomware groups will “go private,” meaning they will no longer publicly recruit affiliates on public forums, or will unwind their current operations and rebrand under a new name.

Ransomware groups could also alter their current practice of encrypting data so it’s unusable by the victim while also downloading the data and threatening to make it public. This double-extortion method aims to increase the pressure on victims to pay. The Babuk ransomware group recently started phasing out its use of malware that encrypts data while maintaining its blog that names and shames victims and publishes their data.

“This approach allows the ransomware operators to reap the benefits of a blackmail extortion event without having to deal with the public fallout of disrupting the business continuity of a hospital or critical infrastructure,” the Intel471 analysts wrote in the email.

For now, the only evidence that Darkside’s infrastructure and cryptocurrency have been seized is the words of admitted criminals, hardly enough to consider confirmation.

“I could be wrong, but I suspect this is simply an exit scam,” Brett Callow, a threat analyst with security firm Emsisoft told Ars. “Darkside get to sail off into the sunset—or, more likely rebrand—without needing to share the ill-gotten gains with their partners in crime.”

Continue Reading

Biz & IT

Ireland’s healthcare system taken down after ransomware attack

Published

on

Enlarge / St. Vincent’s University Hospital in Dublin, Ireland.

Bloomberg | Getty Images

Ireland has shut down most of the major IT systems running its national healthcare service, leaving doctors unable to access patient records and people unsure of whether they should show up for appointments, following a “very sophisticated” ransomware attack.

Paul Reid, chief executive of Ireland’s Health Service Executive, told a morning radio show that the decision to shut down the systems was a “precautionary” measure after a cyber attack that impacted national and local systems “involved in all of our core services.”

Some elements of the Irish health service remain operational, such as clinical systems and its Covid-19 vaccination program, which is powered by separate infrastructure. Covid tests already booked are also going ahead.

However the system for processing referrals from GPs and of close contacts is down, the HSE tweeted, adding that those in need of testing should go to walk-in centers which would prioritize symptomatic cases.

“This is having a severe impact on our health and social care services today, but individual services and hospital groups are impacted in different ways. Emergency services continue, as does the @AmbulanceNAS [National Ambulance Service],” health minister Stephen Donnelly wrote on Twitter.

No group has yet claimed responsibility for the attack, though Reid said on Friday morning that it involved “Conti, human-operated ransomware”, referring to the type of software used. He added that the HSE had not yet been served with a ransom demand.

“We are at the very early stages of fully understanding the threat, the impact and trying to contain it,” he said, adding that it was receiving assistance from the Irish police force, defence forces and third-party cyber support teams.

The master of Dublin’s Rotunda Maternity Hospital said it was advising patients who were less than 36 weeks pregnant not to present for appointments on Friday. In a statement, Cork University Hospital said patients should present for outpatient appointments, chemotherapy and surgery “unless you are contacted to cancel,” but that X-ray and radiotherapy appointments for Friday were cancelled.

Professor Donal O’Shea, consultant endocrinologist at St Vincent’s Hospital in Dublin, told RTE radio that there could be implications for patient care. “Clinical systems haven’t been targeted, but if you can’t access your computer, then getting results is impossible…  so before long, there are going to be clinical implications,” he said. In its statement, Cork University Hospital said “only emergency bloods” would be processed at this time.

Reid said that patients nationally “should still come forward until they hear something different” and that an update should be available later on Friday. A spokeswoman for the HSE was unable to provide a further update on patient care by mid-morning. “We apologize for the inconvenience to the public and will give further information as it becomes available,” she added.

Healthcare workers told the FT they were told to turn off their laptops, leaving staff at home offline and those working in hospitals reverting to pen and paper to manage patients’ information.

In a statement on its website, Ireland’s child and family agency Tusla said that its emails, internal systems and portal for child protection referrals was also offline because it was hosted by the HSE’s network.

The attack comes as actions by cyber criminals to disrupt public services have increased during the pandemic. Earlier this month, hackers believed to be from eastern Europe breached the IT systems of the Colonial Pipeline, a major fuel conduit that supplies much of the eastern US.

“Opportunistic cyber attackers targeting flooded healthcare organizations has been a common theme throughout the course of the pandemic,” said Charlie Smith, consulting solutions engineer at Barracuda Networks. “These scammers are aware of the huge significance of health services’ IT systems at this time, and so will stop at nothing to disrupt said systems or steal valuable data in exchange for ransom.”

© 2021 The Financial Times Ltd. All rights reserved Not to be redistributed, copied, or modified in any way.

Continue Reading

Biz & IT

Biden signs executive order to strengthen US cybersecurity

Published

on

Joe Biden signed an executive order on Wednesday in an attempt to bolster US cybersecurity defenses, after a number of devastating hacks including the Colonial pipeline attack revealed vulnerabilities across business and government.

“Recent cybersecurity incidents… are a sobering reminder that US public and private sector entities increasingly face sophisticated malicious cyber activity from both nation-state actors and cyber criminals,” the White House said.

Under the order, federal agencies will be required to introduce multi-factor authentication to their systems and encrypt all data within six months in a bid to make it harder for hackers to penetrate their IT infrastructure.

The order also requires IT providers that contract with the government to meet higher security requirements and report to them if their systems have been breached. There would be strict timelines for disclosure on a sliding scale based on the severity of the incident, a senior administration official said.

A pilot of a new star rating system for software sold to the government will also be launched, so that the officials and the public can judge how secure it is.

The measures come in the wake of the SolarWinds hack, in which Russian hackers hijacked American-made software to conduct espionage campaigns that targeted dozens of businesses, plus agencies including the US commerce and Treasury departments.

Earlier this year, it emerged that Chinese state-backed hackers had also been conducting stealthy attacks on multiple targets by exploiting recently disclosed vulnerabilities in Microsoft software.

The order also comes after a ransomware attack by a group of cyber criminals crippled a key East Coast pipeline run by Colonial on May 7, causing a run on petrol and fuel shortages. The 5,500-mile pipeline system resumed operations on Wednesday.

“These incidents share commonalities, including insufficient cybersecurity defenses that leave public and private sector entities more vulnerable to incidents,” the White House said.

In an effort to streamline government cyber defenses, the order seeks to introduce a “playbook” for how government agencies should respond to incidents, and improvements in logging and information-sharing following breaches.

It also sets up a private-public sector board, to be named the Cybersecurity Safety Review Board, tasked with analyzing large cyber incidents after they have occurred and making recommendations to prevent them happening again.

The board, which is modeled on the National Transportation Safety Board that investigates airplane and train crashes, would first be tasked with reviewing the SolarWinds hack, the senior administrative official said.

© 2021 The Financial Times Ltd. All rights reserved Not to be redistributed, copied, or modified in any way.

Continue Reading

Trending