source: inc.com

 Predicting the future is hardly an exact science, but when you watch an industry closely it is possible to identify trends and chart a course for where things are likely headed. Here are predictions made by 31 successful executives who believe they can see what will be different in 2019.

1. Amazon's next move will be in hospitality.

"In the past year, Amazon has entered new spaces like grocery and health care, has hinted at venturing into banking, and is even selling live Christmas trees--so what's next? If you look at consumer share-of-wallet as an indicator, one other area that's ripe for Amazon expansion is hospitality. They've just started dipping their toes into local services like house cleaning and handymen. I see great potential value for Amazon to venture into travel and restaurants and leverage its enormous customer base to capture a share of the hospitality spend in 2019."

--Amit Sharma, founder and CEO of Narvar, a customer-engagement platform used by more than 500 retailers, including Sephora, Patagonia, Home Depot, and Gap

2. Cyber attacks will move into the real world.

"[Next year] will be the year of cyber-physical hacking. We've seen the damage a ransomware attack can cause on a company's digital assets, but what happens when we move beyond cyberspace and into the real world? From attacks on manufacturing equipment to surveillance cameras to data centers, we're talking about extremely costly and damaging events that have the power to shut down business operations entirely. Unfortunately, this could be the year of the cyber wake-up call the industry has warned about for years."

--Amit Yoran, first-ever director of the Department of Homeland Security's U.S. Computer Emergency Readiness Team and current CEO of Tenable, which just had one of the biggest cybersecurity IPOs in five years

3. Security will move upstream.

"Everybody is waking up to the fact that data security is a critical problem that needs to be addressed earlier in the development process. This is true not only for customers whose data is on the line, but also for business leaders and software developers who are charged with protecting it. Today, these parties are trying to understand how they can incorporate security into their DevOps process. In 2019, businesses will implement what they have learned. Tech leaders will educate developers on how to avoid errors like coding security holes into their apps. Additionally, developers will increasingly add security detection features at the code level. Not only will code be better protected against intruders; it will watch out for anomalous activity as well."

--Derek Choy, CIO of Rainforest QA, an on-demand quality-assurance testing company that was recently named one of Inc.'s 2018 "Best Places to Work" and services hundreds of companies, including Adobe, Oracle, and SolarWinds

4. Customer success will be the new growth for startups.

"As the foundation for growth within a B2B organization, customer success will play a more critical role within companies in 2019. Traditionally, enterprise sales were focused on new logos, which missed opportunities to nurture existing customers. Growth would then suffer as a result. Without a stable base of customers, companies can't grow as fast because they are constantly filling a leaky bucket. In 2019, we will see a new lens on customer economics, from churn to retention and cohort growth."

--Dale Chang, operating partner at Scale Venture Partners, a venture capital firm that invests in early-in-revenue enterprise software companies such as DocuSign, Box, and HubSpot, and raised $400 million to close its sixth fund earlier this year

5. The workspace will evolve.

"The rise of A.I. and automation software means humans are moving away from repetitive tasks and are increasingly focused on tasks only humans can do: think creatively and interact with other humans. For workspaces, this means people spend less time sitting at their desks and more time in a diversity of settings. The most innovative companies are no longer thinking about workspace as a single location, but rather a network of spaces that employees can access based on what they are trying to achieve--brainstorm a new product, train a new sales team, impress a client, or work quietly on their own. Uber and Spotify have revolutionized access to music and mobility, by giving everyone a private driver or a personalized playlist for a specific occasion. Employees will increasingly expect the same level of choice and diversity from their workspace."

--Dror Poleg, real estate and strategy adviser at Breather, a provider of space-as-a-service across 10 cities, serving more than 500,000 people and used by companies such as Spotify, Away, and Tesla

6. People will stop talking about containers.

"Containers are the hottest topic in enterprise IT since the cloud itself. For a while, everyone was obsessed with what technology leaders like Google were doing with the technology, and the top three topics of conversation at any DevOps

 source: securityintelligence.com

Microsoft Windows Defender Research discovered an attack campaign that utilized spear phishing emails impersonating U.S. Department of State employees to gain remote access to victims’ machines.

Investigators said the majority of those targeted in the campaign, which began in mid-November, were public-sector institutions and non-governmental organizations based in the U.S. The spear phishing emails purported to be notifications from Microsoft’s cloud-based storage system, OneDrive, that indicated a State Department employee had a file they wanted to share.

Those who fell for the bait unleashed an obfuscated PowerShell command and a dynamic-link library (DLL) payload that gave threat actors the ability to control victims’ devices from a command-and-control (C&C) server.

What Happens When Threat Actors Use CobaltStrike

While threat actors often spend considerable time developing their own malicious software code, investigators said those behind this particular attack campaign also made use of CobaltStrike, a commercially available tool that is normally used for penetration testing.

If attackers gained access to a victim’s machine, they could use CobaltStrike to download and install additional software, capture what users input into their systems, execute arbitrary commands through Windows Management Instrumentation (WMI) or PowerShell, and escalate privileges.

While third-party analysts attributed the attacks to a group known as APT29, or CozyBear, which coincides with a group Microsoft calls YTTRIUM, Microsoft does not yet believe that enough evidence exists to attribute this campaign to YTTRIUM.

The Best Way to Shield Against Spear Phishing

As with similar spear phishing attacks, this campaign shows how adept cybercriminals have become in using what look like legitimate names and subject matter in their messages to compel a response — in this case, what looked like an important communication from the Department of State.

In a recent SecurityIntelligence podcast, IBM X-Force Red senior security consultant Chris Sethi described the need for an internal awareness program about adhering to IT security best practices, such as not clicking on potentially malicious links and attachments. The safest organizations take this one step further by having a third party conduct routine tests to ensure employees are putting the right behaviors into practice.

 source: sciencedaily.com

Researchers at the University of Waterloo have taken a huge step towards making smart devices that do not use batteries or require charging.

These battery-free objects, which feature an IP address for internet connectivity, are known as Internet of Things (IoT) devices. If an IoT device can operate without a battery it lowers maintenance costs and allows the device to be placed in areas that are off the grid.

Many of these IoT devices have sensors in them to detect their environment, from a room's ambient temperature and light levels to sound and motion, but one of the biggest challenges is making these devices sustainable and battery-free.

Professor Omid Abari, Postdoctoral Fellow Ju Wang and Professor Srinivasan Keshav from Waterloo's Cheriton School of Computer Science have found a way to hack radio frequency identification (RFID) tags, the ubiquitous squiggly ribbons of metal with a tiny chip found in various objects, and give the devices the ability to sense the environment.

"It's really easy to do," said Wang. "First, you remove the plastic cover from the RFID tag, then cut out a small section of the tag's antenna with scissors, then attach a sensor across the cut bits of the antenna to complete the circuit."

In their stock form, RFID tags provide only identification and location. It's the hack the research team has done -- cutting the tag's antenna and placing a sensing device across it -- that gives the tag the ability to sense its environment.

To give a tag eyes, the researchers hacked an RFID tag with a phototransistor, a tiny sensor that responds to different levels of light.

By exposing the phototransistor to light, it changed the characteristics of the RFID's antenna, which in turn caused a change in the signal going to the reader. They then developed an algorithm on the reader side that monitors change in the tag's signal, which is how it senses light levels.

Among the simplest of hacks is adding a switch to an RFID tag so it can act as a keypad that responds to touch.

"We see this as a good example of a complete software-hardware system for IoT devices," Abari said. "We hacked simple hardware -- we cut RFID tags and placed a sensor on them. Then we designed new algorithms and combined the software and hardware to enable new applications and capabilities.

"Our main contribution is showing how simple it is to hack an RFID tag to create an IoT device. It's so easy a novice could do it."

The research paper by Wang, Abari and Keshav titled, Challenge: RFID Hacking for Fun and Profit-ACM MobiCom, appeared in the Proceedings of the 24th Annual International Conference on Mobile Computing and Networking, October 29-November 2, 2018, New Delhi, India, 461- 70.

 source: cyware.com

  • A new Android malware was hidden behind six different Android applications that were available in Google Play, out of which five apps were removed from Google Play in February 2018.
  • The applications have been downloaded 100,000 times by users in 196 countries, with the majority of victims residing in India.

Researchers spotted a new Android malware hidden behind six different Android applications that were available for download in Google Play. The six apps include Flappy Birr Dog, Flappy Bird, FlashLight, Win7Launcher, Win7imulator, and HZPermis Pro Arabe. Out of these six apps, five have been removed from Google Play since February 2018.

However, these applications have been downloaded at least 100,000 times by users across 196 countries with the majority of victims residing in India. The affected countries include India, Russia, Pakistan, Bangladesh, Indonesia, Brazil, Egypt, Ukraine, Turkey, United States, Sri Lanka, Italy, Germany, Saudi Arabia, and more.

Modus Operandi

Researchers from TrendMicro detected spyware dubbed as ANDROIDOS_MOBSTSPY which is capable of stealing information such as user location, call logs, SMS conversations, and clipboard items. The malware uses Firebase cloud messaging to send information to its C2 server.

  • Once the malicious application is installed and launched, the malware first checks for the device’s network availability.
  • The malware then reads and parses an XML configuration file from its C2 server.
  • Then, the malware collects device information such as the language used, its registered country, package name, device manufacturer, and more.
  • It then sends the collected information to its C2 server.
  • Once executed, the malware waits and then performs the command received from its C2 server via FCM.
  • The malware can steal call logs, SMS conversations, contact lists, user location etc based on the command it received from its C2 server.

Other capabilities of the Malware

The capabilities of the malware include,

  • Stealing and uploading files on the device.
  • Stealing additional credentials through phishing attacks.
  • Stealing user credentials by displaying fake Facebook and Google pop-ups and display screens.

Most users will not doubt the fake screens or pop-ups and are most likely to fall prey for the attack. When the users provide their username and password for the first time, the malware shows them that the log-in was unsuccessful, but the login credentials have already been stolen by the malware.