Skip to content

名為ESPecter之惡意軟體進而藉由EFI系統磁區(EFI System Partition,ESP)展開攻擊行動

透過電腦開機的統一可延伸韌體介面(UEFI)的攻擊手法,近年來被資安人員發現了數個惡意軟體,且攻擊極為隱蔽而難以察覺、因應。就在10月初國際資安大廠ESET再度揭露新的惡意軟體ESPecter,它藉由EFI系統磁區(EFI System Partition,ESP),而能持續在受害電腦運作,讓攻擊者得以繞過Windows的驅動程式強制簽章機制(DSE),進而載入未簽章的驅動程式,以便進行其他攻擊行動。

研究人員對於這個惡意軟體進行分析,在被植入ESPecter的受害電腦上,看到具有鍵盤側錄與竊取文件能力的元件,由此推斷ESPecter主要被用於間諜攻擊行動。根據調查,ESPecter的攻擊最早可追溯到2012年,而當時是以BIOS啟動套件的方式執行,但這個惡意軟體發展至今,已能植入UEFI韌體的電腦。

ESET表示並不清楚ESPecter背後的攻擊者身分為何,但根據用戶端元件的訊息裡含有簡體中文,他們認為或許與使用中文的駭客有關。

攻擊者在受害電腦植入ESPecter之後,這個啟動工具會竄改Windows啟動管理器,而能在作業系統完全載入之前的早期啟動階段,執行沒有簽章的驅動程式,並繞過Windows驅動程式的強制簽章要求。而這個沒有簽章的驅動程式,攻擊者再以其他使用者模組的組件注入,並啟動ESPecter和C2中繼站伺服器的連線,使得攻擊者能掌控受害電腦,執行C2命令,或是下載、執行其他的惡意軟體。而受這種攻擊手法影響的範圍,包含執行Windows 7至Windows 10的電腦。其中,研究人員指出,當中竄改Windows啟動器檔案(bootmgfw.efi)的手法,必須關閉UEFI安全開機才能達成。但攻擊者如何關閉受害電腦的安全開機功能,研究人員推斷有可能攻擊者實際接觸到受害電腦,或者是利用UEFI漏洞而能夠達成。

過往針對UEFI韌體攻擊的惡意軟體,主要是濫用SPI快閃記憶體,包含ESET之前在2018年揭露的LoJax,以及其他資安業者於2019年發現的MosaicRegressor。而這次發現的ESPecter,其他資安業者於今年9月底揭露的FinSpy(亦稱為FinFisher),都是鎖定EFI系統磁區下手。在此之前,這種攻擊EFI系統磁區的手法,只有出現在概念性驗證(PoC)的攻擊程式,並未於實際的攻擊行動出現。不過,ESET強調,ESPecter和FinSpy兩者之間沒有直接關連;最後ESET資安專家建議使用者要嚴加防範,電腦請使用最新版本的韌體,並確定安全開機(Secure Boot)功能開啟,並留意特殊權限的管理,避免高權限帳號遭到攻擊者濫用。

原文出處:https://www.welivesecurity.com/2021/10/05/uefi-threats-moving-esp-introducing-especter-bootkit/

#若有任何資安需求,歡迎洽詢台灣二版資安專業團隊,服務電話:(02)7722-6899,或上官網查詢:https://version-2.com.tw/  

關於 Version 2 Digital
資安解決方案 專業代理商與領導者
台灣二版 ( Version 2 ) 是亞洲其中一間最有活力的 IT 公司,多年來深耕資訊科技領域,致力於提供與時俱進的資安解決方案 ( 如EDR、NDR、漏洞管理 ),工具型產品 ( 如遠端控制、網頁過濾 ) 及資安威脅偵測應 變服務服務 ( MDR ) 等,透過龐大銷售點、經銷商及合作伙伴,提供廣被市場讚賞的產品及客製化、在地化的專業服務。

台灣二版 ( Version 2 ) 的銷售範圍包括台灣、香港、中國內地、新加坡、澳門等地區,客戶涵 蓋各產業,包括全球 1000 大跨國企業、上市公司、公用機構、政府部門、無數成功的中小企業及來自亞 洲各城市的消費市場客戶。

關於ESET
ESET成立於1992年,是一家面向企業與個人用戶的全球性的電腦安全軟體提供商,其 獲獎產品——NOD32防病毒軟體系統,能夠針對各種已知或未知病毒、間諜軟體 (spyware)、rootkits和其他惡意軟體為電腦系統提供實時保護。ESET NOD32佔用 系統資源最少,偵測速度最快,可以提供最有效的保護,並且比其他任何防病毒產品獲 得了更多的Virus Bulletin 100%獎項。ESET連續五年被評為“德勤高科技快速成長500 強”(Deloitte’s Technology Fast 500)公司,擁有廣泛的合作夥伴網絡,包括佳 能、戴爾、微軟等國際知名公司,在布拉迪斯拉發(斯洛伐克)、布里斯托爾(英國 )、布宜諾斯艾利斯(阿根廷)、布拉格(捷克)、聖地亞哥(美國)等地均設有辦事 處,代理機構覆蓋全球超過100個國家。

正常運行時間/SLA 計算器:什麼是 SLA 以及如何計算它?

What is an SLA?

A Service Level Agreement (SLA) is a document that details the expected level of service guaranteed by a vendor or product. This document generally sets out metrics such as uptime expectations and any payoffs if these levels are not met.

For example, if a provider advertises an uptime of 99.9% and exceeds 43 minutes and 50 seconds of service downtime, technically the SLA has been breached and the customer may be entitled to some type of remuneration depending on the agreement.

What do we want SLAs for?

A Service Level Agreement (SLA) specifies the quality of a service. It is a way of defining the limit of failures or times in which the response to a service is measured. Each service measures its quality in a different way, but in all cases it refers to times, and therefore it can be measured.

For example, if you worked in a restaurant, you would define your customer service SLA with several parameters:

  • Maximum time since a customer sits at the table and is served by a waiter.
  • Maximum time since you order the drink and it is served to you.
  • Maximum time since requesting the bill and paying.

Suppose that in our restaurant, we consider that the most important thing is the initial attention, and that no more than 60 seconds can go by, from when you sit down to when you are served. If we had a fully sensorized business with IoT technology, we could measure the time from when the customer sits at a table until a waiter approaches the table.

That way, we could measure the number of times each waiter manages to serve a customer in the established time. The way to do it can be more or less simple, but let’s keep it simple, suppose that every time they do it in less than 60 seconds they comply and when they do not make it, they do not comply. So if out of ten clients they serve in an hour, they fail only with two, they would be 80% compliant. We could make the average of their entire work day and thus easily compare different employees to find out which one has more “quality” in the metric of “serving a customer when they sit down.”

If we use a monitoring system, we could notify their manager every time that the overall quality of the service drops below 80% and by generating automatic reports, we could each month reward those with the best service compliance percentage and take measures (or fire) for those who are doing it worst.

One of the most important functions of monitoring systems is to measure. And measuring service compliance is essential if we care about quality. Whether we are on the provider side or on the client side.

If you are paying for a service, wouldn’t you like to check that you are actually getting what you pay for?

Sometimes we do well not to trust the measurements of others, and it is necessary to check it for “ourselves.” For this, monitoring tools such as Pandora FMS are essential.

What is the «uptime» or activity time?

Uptime is the amount of time that a service is available and operational. It is generally the most important metric for a website, online service, or web-based provider. Sometimes uptime is mistaken with SLA, but uptime is nothing more than a very common metric in online services that is used to measure SLAs, not an SLA, which as we have seen before is something much broader.

The trade-off is downtime – the amount of time a service is unavailable.

Uptime is usually expressed as a percentage, such as “99.9%”, over a specified period of time (usually one month). For example, an uptime of 99.9% equals 43 minutes and 50 seconds of inactivity.

What are the typical metrics of a supplier?

Those that are agreed between the supplier and the client. Each service will have its own metrics and indicators. Thus, in our Monitoring as a Service (MAAS) we can establish several parameters to be measured, among others, let’s see some of them to better understand how to «measure the service quality» through SLA:

  • Minimum response time to a new incident, 1 hr in standard service.
  • Critical incident resolution time: 6 hours in standard service.
  • Service availability time, 99.932% in the standard service.

When we talk about a time percentage, it generally refers to the annual calculation, so 99.932% corresponds to a total of 5h 57m 38s of service shutdown in a year. We can use our SLA calculator (below to test other percentages).

On the contrary, 1hr would be the inverse calculation, and for this we can use online tools such as uptime.is. By using it we will get that six hours would correspond to:

  • Weekly reporting: 99.405 %
  • Monthly reporting: 99.863 %
  • Quarterly reporting: 99.954 %
  • Yearly reporting: 99.989 %

Similarly to the initial waiter example, we can measure compliance with a support SLA by measuring the sum of several factors, if all are met, we are meeting the SLA, otherwise we’re not. This is how Integria IMS measures it, the helpdesk component integrated in Pandora FMS. Pandora FMS clients use Integria for support, and thanks to it we can ensure that we attend to client requests on time.

Error: Embedded data could not be displayed.

How to calculate the service SLA time?

Use our online calculator to calculate a service downtime. For example, test 99.99% to see the maximum downtime for a day, a month, or the entire year.

How can Pandora FMS help with SLAs?

Pandora FMS has different tools to exhaustively control the SLAs of your client/supplier. You have SLA reports segmented by hours, days or weeks. That way you can visually assess where the defaults are.

This is an example of an SLA report in a custom time range (one month) with bands by ranges of a few minutes.

There are reports prepared to show the case of information sources with backup so that you can find out the availability of the service from the customer’s point of view and from the internal point of view:

This is an example of a monthly SLA view with detail by hours and days:

This is an example of a monthly SLA report view with a weekly view and daily detail:

This is an example of an SLA report view by months, with simple views by days:

Service monitoring

One of the most advanced functions of Pandora FMS is monitoring services with Pandora FMS. It is used to continuously monitor the status of a service, which, as we have seen at the beginning, is made up of a set of indicators or metrics. This service often has a series of dependencies and weightings (there are things more important than others) and all services have a certain tolerance or margin, especially if they are made up of many elements and some of these are redundant.

The best example is a cluster, where if you have ten servers, you know that the system works perfectly with seven of them. So the service as such can be operational with one, two or up to three machines failing.

In other cases, a service may have non-critical elements, which are part of the service and that we want to control, even if the service is not affected:

One of the advantages of service monitoring is that you can easily get the route to failure, literally being able to find the needle in the haystack. When you talk about technology, the source of a problem can be somewhat tiny compared to the amount of data you receive. Services help us determine the source of the problem and isolate ourselves from informational noise. They also allow to monitor the degree of service compliance in real time and take action before the quality of the service for a customer is affected.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

因為不僅秋天在十月還有一席之地:網絡安全宣傳月。

Is Cybersecurity Awareness Month the event of the year?

Welcome back to the incredible and majestic Pandora FMS blog. In today’s post, we are going to deal with an event belonging to the month of October, that depressing month in which we become aware of fall, it is colder and someone keeps cutting short our daylight hours. If April is the month of flowers and November the month of the male mustache for testicular cancer, October is the Cybersecurity Awareness Month.

What is Cybersecurity Awareness Month?

Cybersecurity Awareness Month, which is commemorated every October, was created between the United States government and national industry to ensure that everyone had the necessary resources to stay safe and secure online.

Since its inception, under the supervision of the US Department of Homeland Security and the National Cyber Security Alliance, Cybersecurity Awareness Month has grown stronger and more widespread, reaching out to millions of users and businesses, and all types of corporations and institutions. Today, in 2021, it continues to make an impact, and not only in its country of origin, it already does around the world because, who would not join the cause of feeling more protected in these times we live in?

Cybersecurity Awareness Month: Origins

As we’ve explained, the National Cyber Security Alliance and the US Department of Homeland Security launched Cybersecurity Awareness Month in October as a shared effort to help Americans stay safe online. And they did it a few of years ago, at least all those that distance us from October 2004.

When a baby starts to walk, the first steps are short and simple. So were the early Cybersecurity Awareness Month awareness efforts. Most of them focused on giving recommendations on how to update the antivirus, at least twice a year. But little by little they increased their ambitions, their reach and their participation. For example, launching complex campaigns in the industry, involving clients, NGOs and even university campuses.

The organizers made it clear in these years that responsibility for cybersecurity problems is fully shared. From large companies to small users with their battered laptops, all of us must protect our digital treasures and always keep them under supervision.

The European Cybersecurity Month (ECSM)

What is European Cybersecurity Month? The European Cybersecurity Month works, like the American Cybersecurity Awareness Month, as an annual campaign devoted to promoting cybersecurity among users, companies and institutions. The only difference is that the European Cybersecurity Month is promoted by the European Union.

Throughout the month of October, safety information is provided online and awareness is raised through good practices. Activities are carried out around the entire continent: conferences, workshops, seminars, presentations, etc. Everything in order to make us finally aware of digital hygiene.

We must thank the European Union Agency for Cybersecurity (ENISA) and the European Commission for the fruitful month of European Cybersecurity Month, which, of course, has the full support of the EU Member States.

Some events of Cybersecurity Awareness Month

Like the Homecoming Week for high schools, Cybersecurity Awareness Month is also divided into different segments. We are going to list those established by the National Cybersecurity Alliance this year, 2021.

First week

The first week will be themed on creating strong passwords, using multi-factor authentication, backing up data, and updating software.

Only that way will we be able to realize how dependent we are on technology and reconsider the amount of personal and commercial data that we treasure on platforms located on the Internet. There, at the hand of any cybercriminal.

Second week

The motto? “You must be careful with emails, text messages, and chats opened by strangers and incognitos.” You are just one click away from a suspicious email, link, or attachment, to bother the hell out of you. Indeed phishing and digital scams in general have been on the rise since we began with this pandemic. Since we have the damn COVID among us, phishing attacks represent more than 80% of reported security incidents.

Third week

The third week of Cybersecurity Awareness Month will be focused on supporting, inspiring and applauding students who have chosen, or want to choose, a university career focused on cybersecurity. Whether they are teenagers, adults or confused kids who want to change fields of study. Cybersecurity is cool, youngster! It is fully growing and has space and credits for everyone!

Fourth week

This week we will try to make security a priority for companies more than ever. Incorporate security in products, processes, tools… Promote cybersecurity in employees and teams. Get cybersecurity in the minds of department heads until they themselves celebrate the vanguards and news of this discipline on a daily basis.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

系統和網絡的關鍵概念

Together we check out the key concepts of systems and networks

In the middle of the information century, who has not surfed the Internet or used a computer, be it a desktop or a laptop? But do you really know what a computer is and what it is made of? and what about the Internet?

It is important to know at least the most superficial layer of something as important as computer systems and networks, and therefore, we are going to talk about the key concepts of these two topics.

A computer system is a device made up of the union of hardware and software, which allows the use of this system by a person, whether qualified or not, that depends on the purpose of the system.

But, what does “hardware” and “software” mean? Let’s talk a little more about it.

You can define as hardware the set of physical components that make up a computer system. We are going to define the main components of a computer system, although there are a few more:

  • Processor: It is the component in charge of executing all the system programs. It is in turn made up of one or more CPUs.
  • RAM memory: This component stores the data and instructions executed by the CPUs and other system components.
  • Hard Drives: Information and content are stored here in computer systems.
  • Motherboard: It is the component where the others are located, and works as a bridge for communication between them.

Well, now that we have a basic understanding of what hardware is, we move on to software.

Software are all the programs that run on a computer system, among which you may differentiate three types of software:

  • System Software: It is responsible for the proper functioning of the operating system and hardware in general, such as device drivers.
  • Programming software: They are tools whose sole purpose is the development of new software.
  • Application software: It is any program designed to perform one or more specific tasks, for example video games or applications designed for business or education.

We already know what a computer system is, but without communication with the outside we are not making the most out of the potential that these systems have (which is a lot), so we decided to connect it to that abstract site full of information and services: the ‘Internet’.

Everyone knows the term “Internet”, but do we know what the “Internet” is?
We could say that the Internet is the great global network that unites all existing devices, allowing communication between all of them from anywhere on the planet. In turn, this large network is made up of other smaller networks, such as those of a country, city, neighborhood, etc.
Mainly, we distinguish three types of networks:

  • LAN: It is the smallest network, a local area network, such as the one in work areas or the one you have at home.
  • MAN: It is a somewhat larger network, being able to cover from neighborhoods to cities. They can also be the networks used by large companies for communication between their different offices.
  • WAN: It is a network that connects countries or even continents to each other, not devices. We can say that the Internet is the ultimate WAN network.

Ok, we already know what the Internet is made of. But, how do devices communicate on these networks? There are systems used to identify each computer on the network, known as IP addresses. An IP address is, basically, the ID or identifier of a device, so it is unique and unrepeatable.

At the beginning, when the idea of an IP address was created, there were only a few dozen computers in the whole world, and this, as we already know, has gotten quite out of control since then. As a result of this increase, they decided to come up with a new concept, known as DNS (for its acronym Domain Name System).

What the DNS protocol does is, basically, translate the domain name that we enter, either in the web browser or in any other program, and convert it into an IP address, with which it communicates with the destination. Of course, all domain names are stored on DNS servers, scattered around the world to avoid connection overload, and to avoid slow name resolutions.

There are a large number of protocols, each with a different purpose. These protocols are grouped in layers, such as application, transport, Internet or access to the network, according to the TCP/IP model. But, that’s not all. We still lack another important concept in relation to communications between devices, what we know as “ports” of a computer system.

Imagine a road, if all the traffic that wants to enter a city only had a single road, what would happen? Well, the same thing happens in computing, and that is why these virtual ports exist.

These ports range from 0 to 65535, but the first 1024 are reserved for “important” protocols, such as the DNS protocol, which we have mentioned above, belonging to the application layer and that uses port 53 for both UDP and TCP connections.

TCP and UDP are two protocols belonging to the transport layer, whose main difference is that the TCP protocol is connection-oriented. That is, the TCP protocol makes sure that the data reaches its destination, while the UDP protocol sends the data, faster but less securely. This data may even not arrive or at least not fully arrive.

The protocols for web connections or HTTP/HTTPS, both belong to the application layer. Depending on which one you choose, it uses a different port. That is, for HTTP connections, port 80/TCP is used, although it is deprecated due to its lack of security, so the standard has become HTTPS connections, which use port 443/TCP and include a security layer based on SSL/TLS.

Connections made through safe channels or SSH, also from the application layer, use port 22/TCP, and thus we could continue with lots of other protocols.

Of course, these ports are a standard in the systems that receive the requests, the client that initiates the request can use any port that is not reserved to send the request and receive this data. As you can see, this is much easier to communicate with servers, although they can also modify their default ports, but the normal thing is that they do not do so if they want to provide a public service.

Finally, we are going to talk about a concept that, due to the pandemic, is the order of the day: the VPN.

As its name indicates (Virtual Private Network), we can define a VPN as a network “tunnel” that is created between client and server, where data are fully encrypted and sent through the Internet. The common use of VPNs is anonymity on the network, since the IP that is exposed is that of the VPN server, or, also, to be able to visit pages that cannot be accessed from the source country.
In the business environment, this tunnel allows direct communication between the client device with any other device in the network of that server, which allows access to an environment as if we were physically in the office of our company. It also allows access control and registration, which otherwise could not be done.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

間諜組織FamousSparrow鎖定飯店入侵

國際資安大廠ESET近期揭露新的網路間諜組織FamousSparrow,鎖定飯店、政府單位入侵,其管道則是透過被許多企業使用的郵件系統Exchange Server,在今年3月初驚傳的重大漏洞ProxyLogon,多個駭客組織在微軟發布修補程式之後,開始運用這個漏洞進行攻擊。這個駭客組織之所以引起ESET關注的原因就在於他們於微軟發布修補程式的隔日(3月3日),就著手運用其Exchange Server漏洞。

ESET根據資料進行分析,認為FamousSparrow該組織至少從2019年8月就開始活動,且主要的攻擊目標為全球的飯店;但除了針對飯店外,也有看到其他的攻擊活動,鎖定對象包括:臺灣、巴西、南非、加拿大、以色列、法國、英國、瓜地馬拉等12國政府單位、國際組織、工程公司,以及法律事務所等行業。

ESET指出,FamousSparrow該組織是經由曝露在網際網路的網頁應用程式,來入侵受害組織的系統,該組織不只鎖定Exchange Server,還有SharePoint、Oracle提供用於管理飯店的商業軟體Opera,並用這些網頁程式已知的遠端程式碼執行(RCE)漏洞,進而在組織內植入惡意程式。一旦成功入侵上述伺服器主機,便會部署多種作案工具: 包含了駭客自行編譯的Mimikatz,以及NetBIOS掃描工具Nbtscan、後門程式SparrowDoor的載入工具,還有疑似用來收集受害電腦記憶體內機密的工具。此洩密工具,其用途是下載ProcDump的應用程式,導出LSASS處理程序裡的資料。

而對於後門程式SparrowDoor的運作方式,ESET也同時說明:當中使用K7 Computing防毒軟體的合法應用程式,名為Indexer.exe,趁機夾帶惡意DLL檔案K7UI.dll,以及加密的Shellcode(MpSvc.dll)。因Indexer.exe需K7UI.dll程式庫才能執行,再加上攻擊者存放此可執行程式的路徑,具備最高載入優先順序,容易觸發DLL劫持攻擊。簡而言之,是先由合法的K7 Computing防毒軟體元件載入惡意程式庫,再執行Shellcode進行解碼程序,最終才在受害電腦編譯並執行後門程式。

另攻擊者可透過這個後門程式,竄改檔名或移除檔案、建立資料夾、傳送檔案資訊、取得檔案大小與寫入時間、外洩特定檔案的內容。此外,為了清除相關的跡證,SparrowDoor也能自我刪除檔案,以及移除能在受害裝置持續運作的配置。

原文出處:https://www.welivesecurity.com/2021/09/23/famoussparrow-suspicious-hotel-guest/

#若有任何資安需求,歡迎洽詢台灣二版資安專業團隊,服務電話:(02)7722-6899,或上官網查詢:https://version-2.com.tw/


關於 Version 2 Digital
資安解決方案 專業代理商與領導者
台灣二版 ( Version 2 ) 是亞洲其中一間最有活力的 IT 公司,多年來深耕資訊科技領域,致力於提供與時俱進的資安解決方案 ( 如EDR、NDR、漏洞管理 ),工具型產品 ( 如遠端控制、網頁過濾 ) 及資安威脅偵測應 變服務服務 ( MDR ) 等,透過龐大銷售點、經銷商及合作伙伴,提供廣被市場讚賞的產品及客製化、在地化的專業服務。

台灣二版 ( Version 2 ) 的銷售範圍包括台灣、香港、中國內地、新加坡、澳門等地區,客戶涵 蓋各產業,包括全球 1000 大跨國企業、上市公司、公用機構、政府部門、無數成功的中小企業及來自亞 洲各城市的消費市場客戶。

關於ESET
ESET成立於1992年,是一家面向企業與個人用戶的全球性的電腦安全軟體提供商,其 獲獎產品——NOD32防病毒軟體系統,能夠針對各種已知或未知病毒、間諜軟體 (spyware)、rootkits和其他惡意軟體為電腦系統提供實時保護。ESET NOD32佔用 系統資源最少,偵測速度最快,可以提供最有效的保護,並且比其他任何防病毒產品獲 得了更多的Virus Bulletin 100%獎項。ESET連續五年被評為“德勤高科技快速成長500 強”(Deloitte’s Technology Fast 500)公司,擁有廣泛的合作夥伴網絡,包括佳 能、戴爾、微軟等國際知名公司,在布拉迪斯拉發(斯洛伐克)、布里斯托爾(英國 )、布宜諾斯艾利斯(阿根廷)、布拉格(捷克)、聖地亞哥(美國)等地均設有辦事 處,代理機構覆蓋全球超過100個國家。

什麼是新的 Pandora FMS 757?

What’s new in Pandora FMS latest release, Pandora FMS 757

Let’s check out together the features and improvements related to Pandora FMS new release: Pandora FMS 757.

NEW FEATURES AND IMPROVEMENTS

Internal messaging system in the Metaconsole

The messaging system has been implemented in the Metaconsole, which now also allows seeing, similarly to nodes, update notices, messages from other users and system notes.

New documentation in Russian

Although the translation is not yet 100% complete, we’re proud to say that the official Pandora FMS documentation is already in five languages: Spanish, English, French, Japanese and now… Russian!

Collection of new plugins

  • Openstack Plugin

New Open Plugin. It captures data from hypervisors and instances remotely through the openstack api.

  • Pandora MongoDB

New Enterprise plugin. It obtains server stats, the databases and their collections. Remote plugin, with support for Mongo Atlas.

  • Plugin Ldap

New Open plugin, it connects to an ldap account and collects stats related to operations, connections, statistics or waiters.

  • Plugin Nginx

Enterprise plugin update. Updated to python 3.

  • Plugin VMware

Enterprise plugin update. Added a Reject parameter to discard agent IP automatic update.

  • Cisco configuration Inventory Plugin

Enterprise plugin update. Added support for Spanish language systems.

  • Plugin Inventario Cisco configuration

Enterprise inventory plugin update. Added option to define credentials in execution parameters.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

超網:它是什麼以及它的用途是什麼?

From now on, let us add “Supernet” into our vocabulary. Learn more!

A set of computers and/or computer equipment connected to each other, and that can exchange data and information, all of those make up a network. The Internet is the network of networks. We could even think that the Internet is the “Supernet”, but we have to tread carefully when using frequently debated terms in computing… For that reason, today, we bring to the fore the term “Supernet” (or Supernetwork), of course always taking an approach from a monitoring perspective.

* Warning: what I write below is my way of looking at things from a practical and sincere point of view. This article only endorses me and, in any case, this entry should be read taking into account the learning approach, it does not intend to be official in any way. That said, let’s start from the basics, which is not the same as starting from scratch.

Terms: Supernet and Supernetting

If we have a network and we buy a new computer, we say that “we add it to a network.” If we have a supernet, then “we add it to a supernet.” We even have a specific verb for it. It is very common to use the term Supernetting; however the following terms are also valid (but less used):

  • Prefix aggregation
  • Route aggregation
  • Route summarization

If we get even more specific, technically we will find differences but for the purposes of this post we will deal with it the same way… Do you think it is daring on my part? Well, there is more!

Request for comments

Although we can go a lot further back in time, the Internet was born in the United States of America, originally called Arpanet, in the late 1960s. A technological predecessor could be the landline from which many of the concepts are born, used when planning the “network of networks”. In fact, the wiring itself, the colors that identify the pairs, are very similar, at a physical or hardware level. This includes the similarities in switched connections (or circuit switching). But, obviously, the Internet and data transport in a digital way ended up completely absorbing telephony.

But the Internet needed more than the physical and conceptual foundation or sustenance of the great American telephone companies. Moreover, October 1969 is marked as the birth of the Internet since the first connection between two computers was made… And it was simply that, since it was not yet a common computer network.

The Internet was born, in my opinion, when pioneer Dr. Steve D. Crocker published the first issue of Request for Comment (RFC) on April 7, 1969. In Issue 6 (RFC 6), Steve Crocker recounts his conversation with Bob Kahn about code conversion for data exchange. RFC 11 publishes the connection implementation in the FAT operating system (yes, that’s what it was called), and I fervently believe that this, published in August 1969, is what enabled the feat performed in October of that same year.

Based on this knowledge base, the RFCs were born: gathering a group of people in their twenties who moved among different universities sharing knowledge and cementing concepts, something that we now do by email… In fact, RFC 733 (1977) outlines this technology and the standard for the email is published in RFC 822 (year 1982).

RFCs grew decade after decade: in 1992, RFC 1338 “Supernetting: an Address Assignment and Aggregation Strategy” was published for information purposes. Yes, at first the supernet was just a mere advertisement, not a protocol, and not even a standard.

Just the following year, in 1993, RFC 1518 “breaks” the paradigm of networks by classes. While class A networks allow millions of IP addresses, the next step – class B networks – only allowed 65 thousand IP addresses: between the two of them the “waste” of IP addresses is very high.

For that reason, the Classless Inter-Domain Routing (better known as CIDR) was born, which is an extension of the original IPv4 addressing system that allows more efficient address allocation. The original class-based method used fixed fields for network identifiers, which was wasteful as I said earlier: most organizations that are assigned those addresses (class A and class B networks) never intended to put so many devices on the Internet.

As additional information, this is the origin of CIDR notation, the suffix that accompanies an IP address (there are 32 bits in an IPv4 address, four octets separated by periods) and that allows describing or narrowing down a range of them. For example, for /20 it allows 4096 IP addresses, for /21 2048 IP addresses and so on, as well as all the way around (all powers of base 2, this is important for a supernet as we will see later). All these numbers can be obtained using the IP address calculator included in Pandora FMS. You may also find many of these calculators online, each with its own style, shapes and colors to present the same data.

Flexible like Pandora FMS

CIDR thus changed the fixed fields to variable length fields and this allowed to assign IP addresses better, and in a more refined way. CIDR IP addresses include a number that indicates how the address is divided between networks and hosts.

For example, in the CIDR address 201.249.0.0/19 the /19 indicates that the first 19 bits are used for the identification of the network and the remaining 13 are used for host identification.

The main purpose of a supernet is to decrease the size of the route table of routers. For example, instead of a router having 8 individual routes, it may have a single route aggregated from these 8 individual routes. This saves memory and processing resources on the routing devices, thus requiring less space to store their route table and less processing power to search the route table. It also provides stability in networks because fluctuations can be isolated, that is, in one part of the network they do not spread to all parts of the network.

Supernetting and Pandora FMS

From Pandora FMS version NG 731 IPAM was included (abbreviation of Internet Protocol Address Management) which allows to manage, discover, diagnose and monitor hundreds of IP addresses.

Within this feature, the supernet, subnets and even virtual private networks (VLAN) are included, all integrated, with the option to export data in CSV files. Unlike creating VLANs, we can only create supernets manually using IPAM. For that, you have to configure, with the necessary parameters, each of the supernets that you want to have, and later add networks already managed with IPAM that may belong to a VLAN. Although it is a manual process from version NG 758, it includes the ability to quickly addy our data from files in CSV format.

To finish off this post, let’s see what the rules that operate a supernet are.

Supernet Rules

Apart from good practices in network configuration, the established rules must always be followed and enforced to avoid chaos reigning.
The rules for creating supernets are as follows:

  • Networks must be contiguous or sequential.
  • The number of networks to add must be a multiple of two or “base two”.
  • And the rule that is somewhat more complicated: compare the value of the first octet not common from the first block of IP addresses (the smallest) of the list of networks to add against the number of networks to add (see previous point). The value of the first non-common octet must be zero or a multiple of the number of networks to be added.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

物聯網分析、可見性和分類,由 Portnox CLEAR 提供支持

IoT/OT Blind Spots Across Your Network

At present, hundreds of millions of IoT/OT devices are in use, and that number continues to rise as organizations increasingly adopt such devices to improve productivity, insight and real-time decision making. Unfortunately, IoT/OT devices are particularly at risk to external and internal cyberthreats due to a lack of device patching and overall visibility and contextual understanding across networks. This makes IoT profiling quite difficult.

The healthcare, hospitality and manufacturing sectors are especially vulnerable due to their heavy reliance on ultrasound machines, avionics, building automation, VoIP, medical devices, printers, computers, networking equipment and energy and power infrastructure. To close this IoT/OT device visibility gap, Portnox CLEAR is introducing its IoT/OT Visibility Add-On, which enables organizations to see, profile and classify all IoT/OT devices on the network without an agent.

IoT Profiling in CLEAR: How it Works

Portnox CLEAR utilizes several methods and leverages multiple data points to actively and passively identify, profile and classify IoT/OT devices across enterprise networks, delivering detailed device profile data that takes into account device families, types, models and vendors.

iot profiling in portnox clear

With the IoT/OT Visibility Add-On, Portnox CLEAR can continuously discovers all IP-connected devices without requiring agents, the instant they enter your network. the add-on provides in-depth visibility into those devices using a combination of active and passive discovery, profiling and classification techniques.

IoT Profiling Capabilities with CLEAR

  • Device Discover – Automatically discover IoT/OT devices without needing to install yet another third-party agent across managed devices.
  • Device Profiling – Classify IoT/OT devices based on type, like MRI machines, printers, sensors and beyond.
  • Device Type Enforcement – Continuously monitor IoT/OT devices and enforce network segmentation and access policy based on device type.

IoT Profiling Advantages with CLEAR

  • Cloud Delivery – Portnox CLEAR leverages a central cloud database that utilizes crowdsourcing and machine learning to deliver better device predictability.
  • Microsegmentation – Automatically segment groups and enforce unique policies to reduce the network attack surface, improve breach containment and strengthen regulatory compliance.
  • Access Control – Define and enforce access control policies based on IoT/OT device types.
  • Complete Asset Management – Be able to report on and visualize in real-time the device types, locations and level of access for every IoT/OT on the network.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。

系統和網絡的關鍵概念

Together we check out the key concepts of systems and networks

In the middle of the information century, who has not surfed the Internet or used a computer, be it a desktop or a laptop? But do you really know what a computer is and what it is made of? and what about the Internet?

It is important to know at least the most superficial layer of something as important as computer systems and networks, and therefore, we are going to talk about the key concepts of these two topics.

A computer system is a device made up of the union of hardware and software, which allows the use of this system by a person, whether qualified or not, that depends on the purpose of the system.

But, what does “hardware” and “software” mean? Let’s talk a little more about it.

You can define as hardware the set of physical components that make up a computer system. We are going to define the main components of a computer system, although there are a few more:

  • Processor: It is the component in charge of executing all the system programs. It is in turn made up of one or more CPUs.
  • RAM memory: This component stores the data and instructions executed by the CPUs and other system components.
  • Hard Drives: Information and content are stored here in computer systems.
  • Motherboard: It is the component where the others are located, and works as a bridge for communication between them.

Well, now that we have a basic understanding of what hardware is, we move on to software.

Software are all the programs that run on a computer system, among which you may differentiate three types of software:

  • System Software: It is responsible for the proper functioning of the operating system and hardware in general, such as device drivers.
  • Programming software: They are tools whose sole purpose is the development of new software.
  • Application software: It is any program designed to perform one or more specific tasks, for example video games or applications designed for business or education.

We already know what a computer system is, but without communication with the outside we are not making the most out of the potential that these systems have (which is a lot), so we decided to connect it to that abstract site full of information and services: the ‘Internet’.

Everyone knows the term “Internet”, but do we know what the “Internet” is?
We could say that the Internet is the great global network that unites all existing devices, allowing communication between all of them from anywhere on the planet. In turn, this large network is made up of other smaller networks, such as those of a country, city, neighborhood, etc.
Mainly, we distinguish three types of networks:

  • LAN: It is the smallest network, a local area network, such as the one in work areas or the one you have at home.
  • MAN: It is a somewhat larger network, being able to cover from neighborhoods to cities. They can also be the networks used by large companies for communication between their different offices.
  • WAN: It is a network that connects countries or even continents to each other, not devices. We can say that the Internet is the ultimate WAN network.

Ok, we already know what the Internet is made of. But, how do devices communicate on these networks? There are systems used to identify each computer on the network, known as IP addresses. An IP address is, basically, the ID or identifier of a device, so it is unique and unrepeatable.

At the beginning, when the idea of an IP address was created, there were only a few dozen computers in the whole world, and this, as we already know, has gotten quite out of control since then. As a result of this increase, they decided to come up with a new concept, known as DNS (for its acronym Domain Name System).

What the DNS protocol does is, basically, translate the domain name that we enter, either in the web browser or in any other program, and convert it into an IP address, with which it communicates with the destination. Of course, all domain names are stored on DNS servers, scattered around the world to avoid connection overload, and to avoid slow name resolutions.

There are a large number of protocols, each with a different purpose. These protocols are grouped in layers, such as application, transport, Internet or access to the network, according to the TCP/IP model. But, that’s not all. We still lack another important concept in relation to communications between devices, what we know as “ports” of a computer system.

Imagine a road, if all the traffic that wants to enter a city only had a single road, what would happen? Well, the same thing happens in computing, and that is why these virtual ports exist.

These ports range from 0 to 65535, but the first 1024 are reserved for “important” protocols, such as the DNS protocol, which we have mentioned above, belonging to the application layer and that uses port 53 for both UDP and TCP connections.

TCP and UDP are two protocols belonging to the transport layer, whose main difference is that the TCP protocol is connection-oriented. That is, the TCP protocol makes sure that the data reaches its destination, while the UDP protocol sends the data, faster but less securely. This data may even not arrive or at least not fully arrive.

The protocols for web connections or HTTP/HTTPS, both belong to the application layer. Depending on which one you choose, it uses a different port. That is, for HTTP connections, port 80/TCP is used, although it is deprecated due to its lack of security, so the standard has become HTTPS connections, which use port 443/TCP and include a security layer based on SSL/TLS.

Connections made through safe channels or SSH, also from the application layer, use port 22/TCP, and thus we could continue with lots of other protocols.

Of course, these ports are a standard in the systems that receive the requests, the client that initiates the request can use any port that is not reserved to send the request and receive this data. As you can see, this is much easier to communicate with servers, although they can also modify their default ports, but the normal thing is that they do not do so if they want to provide a public service.

Finally, we are going to talk about a concept that, due to the pandemic, is the order of the day: the VPN.

As its name indicates (Virtual Private Network), we can define a VPN as a network “tunnel” that is created between client and server, where data are fully encrypted and sent through the Internet. The common use of VPNs is anonymity on the network, since the IP that is exposed is that of the VPN server, or, also, to be able to visit pages that cannot be accessed from the source country.
In the business environment, this tunnel allows direct communication between the client device with any other device in the network of that server, which allows access to an environment as if we were physically in the office of our company. It also allows access control and registration, which otherwise could not be done.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.