Posts

Smart Public Kiosks Enhance Livability, Connect Communities

Cities are busy places, and they’re getting busier. Thankfully, many of them are also getting smarter by enabling smarter parking, better transportation and better air quality management for better citizen experiences. Among the most groundbreaking of innovations contributing to those experiences are smart public kiosks — replacing outdated infrastructure, such as phone booths and static signage, with smart kiosks. From providing environmental sensors and smart lighting to boosting cell reception and serving as a free Wi-Fi hotspot, kiosks enhance quality of life, equity, sustainability and security in a city. They are able to generate new revenue streams for cities through advertising — which can help them to become self-funded —and provide valuable services, such as wayfinding, transit routes, free Wi-Fi, and emergency alerts for more connected experiences between citizens and the services provided by their local governments and businesses.

A person stands in front of a smart public kiosk.

Connecting Citizens to Local Government

Smart public kiosks, such as Intel technology enabled CIVIQ Smartscapes, Intersection and CityBeacon, offer tremendous opportunities to enhance and ease citizens’ quality of life by enabling citizens to more easily access information and connect to the world around them. CityBeacon is an Intel IoT Market Ready Solution — it’s a proven, commercially available today solution that bridges digital and physical worlds providing reliable connectivity and maximum flexibility for smarter city management. For public kiosks, those connections include speakers, large digital signage screens and flashing lights can broadcast public service announcements or missing child alerts. Interactive transit route maps can make navigating public transit easier with wayfinding features. Under the hood, kiosks can also provide powerful Wi-Fi hotspots and strengthen cell phone signals. As kiosks expand their reach, citizens and local governments alike are only beginning to realize the full potential of the technology to empower communities.

A person's finger touches a smart public kiosk.

Enhancing Safety in Public Spaces

From a community health and safety standpoint, kiosks can brighten dark spaces with smart lighting that adjusts to current conditions for better lit, and safer, public spaces. Built-in incident and facial detection features can further enhance safety and enable public safety officers and EMTs to more quickly respond to incidents. Kiosks can even monitor air pollution, helping to contribute to healthier communities.

Growing Local Economies

For local businesses, kiosks are scaling out their digital and interactive display offerings are even more convenient because they have facial detection — they can detect emotions, demographic information and more while maintaining the privacy of consumers. These kinds of cognitive analytics enable the display to engage in a real-time feedback loop, refining messaging in response to the reactions, in order to reach the right consumers with even more precise messaging in the future. From purchasing tours and event tickets, to paying for parking or bus fare, kiosks enable businesses to connect with customers wherever they are, creating amazing experiences along the way.

Engaging and interactive, kiosks support smart city initiatives delivering real-time information, services and alerts to citizens and visitors—quickly and cost-effectively. To learn more, check out the smart kiosk at the village during Smart City Expo World Congress in Barcelona, Nov. 14-16, or visit intel.com/publickiosks.

Learn more about Intel IoT Market Ready Solutions at www.intel.com/iotmarketready. Visit intel.com/retail to learn more about how Intel technology is shaping the future of responsive retail. To stay informed about Intel IoT developments, subscribe to our RSS feed for email notifications of blog updates, or visit intel.com/IoTLinkedInFacebook and Twitter.

 

 


Source: Network News

Access Point Support Subscriptions

WatchGuard access points provide secure, reliable wireless connectivity to businesses around the world. At WatchGuard, we are passionate about mobility and security and are dedicated to keeping wireless environments updated with the latest software features to keep people safe and their businesses running smoothly. For example, at the time of our public announcement of the WPA/WPA2 key reinstallation (KRACK) vulnerability, corrective software was already available online. Additional details about KRACK and software updates for WatchGuard products can be found in this knowledge base article.

Support Subscriptions for Access Points

Standard Support for access points is included in our Wi-Fi service subscriptions: Basic, Secure, and Total Wi-Fi. See this FAQ for more information on the Wi-Fi SKUs. Maintaining active support subscriptions for your access points is recommended to continue to receive important software updates, RMA replacement, and support.

Basic, Secure, and Total Wi-Fi Subscriptions include Standard Support:

  • 24×7 support
  • Unlimited number of support cases per annual subscription
  • Targeted response times:
    • 4 Hour – Critical, High
    • 8 Hours – Medium
    • 24 Hours – Low
  • Web-based support
  • Phone-based support
  • Software updates and patches for:
    • Gateway Wireless Controller
    • Access point firmware
    • Wi-Fi Cloud
  • Advanced hardware replacement
  • Product documentation and guides
  • Technical Training Materials
  • Moderated Customer Forum

At this time, premium four hour RMA is not available for access points.  Please remember to maintain an active Basic, Secure, or Total Wi-Fi subscription with each access point in order to maintain support.

Total Wi-Fi Program Chart

Sincerely,

Ryan Orsi
Director, Product Management, Secure Wi-Fi
WatchGuard Technologies


Source: WatchGuard

WatchGuard Integrates with Autotask PSA to Simplify Managed Security Services

Available with Fireware 12.0.1, WatchGuard has introduced a leading integration with Autotask to simplify managed security services for our global base of mutual Channel Partners. Managed security service providers (MSSPs) using WatchGuard and Autotask can now benefit from closed-looped service ticketing and synchronization of their customers’ asset Information.

Key Features

Integrated, Closed-Loop Service Ticketing — Track Issues with Service Ticketing Made Easy

  • Enable Autotask service tickets for WatchGuard security solutions.
  • Configure event thresholds on a wide range of parameters identified per device, including: security services, device statistics, and subscription statuses. Event thresholds automatically trigger the creation and closure of service tickets, closing tickets when issues are resolved, and reducing the number of false alarms.
  • Eliminate ticket flooding and provide trending visibility into customer security, because the same ticket reopens if the issue returns, rather than creating multiple tickets.

Auto Synchronization of Asset Information — Know a Customers’ Security

  • Automatically register and update customer security asset information.
  • Gain visibility into customer security through automated synchronization with WatchGuard security appliances, including subscription start and end dates, device serial numbers, OS versions, and more.
  • Avoid a managed network going unprotected because of incorrect security service subscription end dates.

Learn more about this integration by visiting our Autotask Integration page, which includes links to an integration guide, demo video, and a solution brief. To view all of our available Technology Partner integrations, visit our Technology Integrations page.


Source: WatchGuard

Fireware 12.0.1 is now available

Fireware 12.0.1 General Availability
We are pleased to announce the General Availability (GA) of Fireware 12.0.1 and WSM 12.0.1 today, along with updates for the Access Point firmware. These releases provide fixes for many reported issues and include some significant security updates. Key highlights: 

  • Patches previously announced in the blog post on KRACK WiFi vulnerabilities, including a new feature to mitigate against the vulnerability in unpatched clients. 
  • Streamlined some UI options for Gateway Antivirus to reflect the new capabilities of the new AV engine that we included in the 12.0 release in September. 
  • A new simple option to enable Support access to the appliance, which will cut down on the time required for support calls, and lead to a smoother experience when customers need to work with support. 

WatchGuard partners and customers should review the Release Notes and What’s New presentations prior to upgrading. 

Does this release pertain to me?
The Fireware release applies to all Firebox T, Firebox M, and XTM appliances, except XTM 21/21-W, 22/22-W, or 23/23-W, which are now End of Life (EOL), and XTM 505, 510, 520, and 530 which are EOL in December of this year.

AV Signatures in 11.x releases
Previously WatchGuard had announced that we would discontinue support for AV signatures for the older AVG engine in Fireware 11.x by January 2018. This support will now be extended until April 2018.

Software Download Center
Firebox and XTM appliance owners with active support subscriptions can obtain this update without additional charge by downloading the applicable packages from the WatchGuard Software Download Center. 

Contact
For Sales or Support questions, you can find phone numbers for your region online. If you contact WatchGuard Technical Support, please have your registered appliance Serial Number or Partner ID available.

 


Source: WatchGuard

Hak5 2307 – Introducing the Packet Squirrel!

Get yours here! https://hakshop.com/
https://www.hak5.org/
Learn more: https://www.hak5.org/gear/packet-squirrel
https://www.hak5.org/gear/packet-squirrel/docs

——————————-
Shop: http://www.hakshop.com
Support: http://www.patreon.com/threatwire
Subscribe: http://www.youtube.com/hak5
Our Site: http://www.hak5.org
Contact Us: http://www.twitter.com/hak5
Threat Wire RSS: https://shannonmorse.podbean.com/feed/
Threat Wire iTunes: https://itunes.apple.com/us/podcast/threat-wire/id1197048999
Help us with Translations! http://www.youtube.com/timedtext_cs_panel?tab=2&c=UC3s0BtrBJpwNDaflRSoiieQ
——————————

Source: Security news


Source: Zologic

Wi-Fi Key Reinstallation Attack “KRACK” Update: Protecting Unpatched Devices

Summary
On October 16, 2017, security researchers announced several vulnerabilities in the WPA/WPA2 encryption protocol that affect countless Wi-Fi enabled devices worldwide. As a result of KRACK, Wi-Fi data streams, including passwords and personal data, can be intercepted, decrypted, and modified without a user’s knowledge. This security flaw means that, for vulnerable clients and access points, WPA- and WPA2-encrypted Wi-Fi traffic is potentially exposed until certain steps are taken to remediate the issue.

Presently, there are 10 known vulnerabilities that comprise KRACK. WatchGuard is providing patches for all of our affected products. For non-WatchGuard devices, users should refer to their vendor’s website and security advisories to determine if they are affected, and if updates are available. Even though most companies will provide patches, it’s likely that unpatched devices will interact with your network and expose you to risk. WatchGuard offers additional methods to protect unpatched client devices from KRACK.

How to Mitigate KRACK
The steps below describe recommended actions to protect your network from KRACK vulnerabilities in various scenarios, including from unpatched client devices.

  1. Update your access point (AP) firmware (10/30/17)
    • WatchGuard will provide patches for all supported APs and tabletop appliances with embedded wireless APs.
  2.  

  3. Enable “Mitigate WPA/WPA2 key reinstallation vulnerability in clients” feature. The AP can compensate for the unpatched clients with this setting enabled. Mitigation is recommended only until all clients are patched.
    • AP managed by GWC: Available for the AP120, AP320, AP322, and AP420 with the upcoming 10/30/17 patch.
    • AP managed by Wi-Fi Cloud (link to WatchGuard Knowledge Base article is below).
    • Firebox with built-in Wi-Fi: Available on the T-10W, T-10W, and T-50W with TBD firmware update.
    • In a small percent of cases, mitigation may exacerbate client connectivity issues in environments already suffering from weak signal coverage or high interference.
  4.  

  5. Enable “AP MAC Spoofing Prevention” setting in Wi-Fi Cloud WIPS policy.
    • AP managed by GWC: manage your APs with a Wi-Fi Cloud license and acquire dedicated WIPS sensors for your environment.
    • AP managed by Wi-Fi Cloud: enable setting in the management interface.

 

Additional Information


Source: WatchGuard

Accelerate Adoption of Remote Care to Dramatically Reduce Costs

There are many challenges to the long-term viability of our healthcare systems. An increasingly older and growing population demanding care amid a shortage of qualified personnel. A shift from infectious to more costly chronic disease management. An evolving policy and regulatory landscape. How can these challenges of cost, quality, and access be addressed?

Providers are increasingly turning to remote care for the answer. The potential of remote care is well documented: It can reduce hospital admissions by as much as 40% while cutting U.S. employer healthcare costs by as much as $6 billion annually.

The benefits seem intuitive enough. By moving healthcare delivery beyond the hospital or clinic and closer to patients, providers can engage more frequently and gather data continuously. This allows them to design better and more proactive and personalized treatments without unnecessary and costly office visits or hospital admissions. And it enables patients to participate more in managing their own health, monitoring their vitals to make smarter decisions that can improve their quality of life.

So why is remote care delivery still not ubiquitous? While its use is increasing, widespread adoption still faces barriers. Foremost among them are security and privacy concerns, integration with existing workflows and technology, and solution flexibility that doesn’t sacrifice reliability and predictability.

But now there’s a new solution that can help address these concerns and help usher in a new generation of remote patient care.

Introducing the Intel Health Application Platform—software that, when coupled with an Intel-architecture-based design specification implemented by a third-party hardware vendor such as Flex, can help enable healthcare solution providers to securely and reliably deliver distributed healthcare services across an always-connected and ever-expanding healthcare edge and to any cloud.

When combined with a third-party hardware design, the Intel Health Application Platform can empower the healthcare industry to develop novel and exciting products and services that require enterprise-grade stability, security, and longevity. All while lowering TCO and delivering better user experiences. Once developed and deployed by healthcare solution providers, these solutions can give care providers access to a new breed of flexible yet robust solutions that can help them provide more informed and proactive diagnoses and treatments.

Intel is helping enable smarter approaches to healthcare delivery at the edge and a new standard for remote patient care.

To stay informed about Intel IoT developments, subscribe to our RSS feed for email notifications of blog updates, or visit intel.com/IoTLinkedInFacebook and Twitter.


Source: Network News

Hak5 2306 – Bash Bunny Phishing Attack With Hamsters

Hak5.org/live to watch the event announcement live!
Hak5.org/rsvp to come to our San Francisco event.

——————————-
Shop: http://www.hakshop.com
Support: http://www.patreon.com/threatwire
Subscribe: http://www.youtube.com/hak5
Our Site: http://www.hak5.org
Contact Us: http://www.twitter.com/hak5
Threat Wire RSS: https://shannonmorse.podbean.com/feed/
Threat Wire iTunes: https://itunes.apple.com/us/podcast/threat-wire/id1197048999
Help us with Translations! http://www.youtube.com/timedtext_cs_panel?tab=2&c=UC3s0BtrBJpwNDaflRSoiieQ
——————————

Source: Security news


Source: Zologic

WPA2 Wi-Fi Vulnerable to KRACK Hack; RSA Keys Broken – ThreatWire

Krack is bad for WiFi, Equifax loses their IRS contract, and an RSA crypto key is vulnerable to being reverse engineered. Today on ThreatWire.

——————————-
Shop: http://www.hakshop.com
Support: http://www.patreon.com/threatwire
Subscribe: http://www.youtube.com/hak5
Our Site: http://www.hak5.org
Contact Us: http://www.twitter.com/hak5
Threat Wire RSS: https://shannonmorse.podbean.com/feed/
Threat Wire iTunes: https://itunes.apple.com/us/podcast/threat-wire/id1197048999
Help us with Translations! http://www.youtube.com/timedtext_cs_panel?tab=2&c=UC3s0BtrBJpwNDaflRSoiieQ
——————————

https://www.krackattacks.com/
https://www.kb.cert.org/vuls/byvendor?searchview&Query=FIELD+Reference=228519&SearchOrder=4
https://github.com/kristate/krackinfo
https://www.wired.com/story/krack-wi-fi-wpa2-vulnerability/
https://arstechnica.com/information-technology/2017/10/severe-flaw-in-wpa2-protocol-leaves-wi-fi-traffic-open-to-eavesdropping/
http://www.zdnet.com/article/here-is-every-patch-for-krack-wi-fi-attack-available-right-now/
https://www.theverge.com/2017/10/16/16481818/wi-fi-attack-response-security-patches

Equifax Takes Down Compromised Page Redirecting to Adware Download

Equifax Credit Assistance Site Served Spyware

https://www.cnet.com/news/equifax-website-ads-served-adware-malware-expert-finds/
https://randy-abrams.blogspot.com/2017/10/new-equifax-website-compromise.html
https://www.cnet.com/news/irs-reportedly-suspends-7-2-million-equifax-contract/
https://arstechnica.com/tech-policy/2017/10/after-second-bungle-irs-suspends-equifaxs-taxpayer-identity-contract/

https://arstechnica.com/information-technology/2017/10/crypto-failure-cripples-millions-of-high-security-keys-750k-estonian-ids/
https://en.wikipedia.org/wiki/Coppersmith%27s_attack
https://www.yubico.com/keycheck/
https://keychest.net/roca

Youtube Thumbnail credit:
https://static.pexels.com/photos/7101/wood-coffee-iphone-notebook.jpg

Source: Security news


Source: Zologic

WPA and WPA2 Vulnerabilities Update

On October 16, 2017, a statement from the International Consortium for Advancement of Cybersecurity on the Internet (ICASI) was released alerting the industry to a series of vulnerabilities for WPA and WPA2. These vulnerabilities are at the protocol-level and affect a large number of wireless infrastructure devices and wireless clients, across many vendors. This security flaw means that, for vulnerable clients and access points, WPA and WPA2-encrypted Wi-Fi traffic is no longer secure until certain steps are taken to remediate the issue. The Wi-Fi data stream, including passwords and personal data, can be intercepted, decrypted, and modified without a user’s knowledge. WatchGuard’s Wi-Fi access points and Wi-Fi enabled appliances are affected by these vulnerabilities. Following is detailed information about the vulnerabilities, which WatchGuard products are affected, and timing for patches.

Who is affected by these vulnerabilities?
Any Wi-Fi client or access point that utilizes the wpa_supplicant or hostapd Open Source software packages in the authentication process may be affected by these vulnerabilities. These are widely used software packages across the industry, so the vast majority of devices will be affected. The ICASI statement linked above includes many, but not all, affected vendors. Organizations that use wireless access points (APs) relying on WPA or WPA2 encryption, and mobile users who connect to Wi-Fi networks with smartphones, tablets, laptops, and other devices, should implement the necessary patches applicable to these vulnerabilities.

How many/what type of vulnerabilities are there?
Refer to the ICASI list of vulnerabilities and Common Vulnerability and Exposure (CVE) identifiers here.

How do the WPA and WPA2 vulnerabilities work?
A malicious user could inject specially-crafted packets into the middle of the WPA/WPA2 authentication handshake, forcing installation of a key known to—or controlled by—the attacker. This results in the possibility of decrypting and/or modifying client traffic. Traffic already protected by a higher-level encryption protocol, such as HTTPS, VPNs, or application encryption would not be impacted.

Depending on the specific device configuration, successful exploitation of these vulnerabilities could allow unauthenticated attackers to perform packet replay, decrypt wireless packets, and to potentially forge or inject packets into a wireless network. This is accomplished by manipulating retransmissions of handshake messages.

When an adversary manipulates certain handshake messages over the air, the exploit results in reuse of some packet numbers when handshakes are performed. The reuse of packet numbers violates the fundamental principle on which the strength of WPA2 encryption and replay security is based. The principle is that for a given key hierarchy, PTK, GTK and IGTK, packet numbers in two original (non-retransmits) packet transmissions protected by them cannot be repeated. For packet pairs where this assumption is violated, it is possible to determine the content of one packet if the plaintext of the other packet is known or can be guessed. Packet number can also permit adversary to replay old packets to the receiver.

Do these vulnerabilities represent a protocol design failure of WPA2?
No, the failure is with the wpa_supplicant or hostapd Open Source software packages, and is not a protocol design failure of WPA2.

Which WatchGuard products were affected?

  • Access Points: AP100, AP102, AP120, AP200, AP300, AP320, AP322, AP420
  • Appliances: XTM 25-W, 26-W, 33-W; Firebox T10-W, T30-W, T50-W

How can WatchGuard partners and customers access patches / updates that address these vulnerabilities?
Patches will be available for Fireware, WatchGuard legacy and current APs, and for WatchGuard Wi-Fi Cloud via the following releases and estimated timing (subject to changes, monitor this blog for patch updates):
Sunday, October 15, 2017:

  • AP120, 320, 322, 420:  Release 8.3.0-657, Cloud mode only

Monday, October 30, 2017:

  • Fireware: Release 12.0.1
  • Legacy AP:
    • AP300: Release 2.0.0.9
    • AP100, 102, 200: Release 1.2.9.14
  • AP120, 320, 322, 420:  Release 8.3.0-657, Non-Cloud (GWC mode)

Have any of WatchGuard’s customers or partners been negatively impacted by these vulnerabilities?
No, we are not aware of any WatchGuard customers or partners who have been negatively impacted by these vulnerabilities.

What is WPA2?
WPA2 (802.11i) is currently the standard for link layer security in Wi-Fi networks. It uses either 802.1x (EAP) or shared key (PSK) based authentication. In 802.1x, the client is authenticated from a backend RADIUS server when setting up a wireless connection. During the authentication process, the client and the RADIUS server generate a common key called Pairwise Master Key (PMK). The PMK is sent from the RADIUS server to the AP over a secure wired network. In PSK, the PMK is statically installed in the client and the AP by entering the same passphrase (password) on both sides. The PMK is then used to generate a hierarchy of keys to be used for encryption and integrity protection for data sent over wireless link between the AP and the client.

The protocol to generate the key hierarchy from PMK is called an EAPOL 4-Way Handshake. It is used to derive the following keys:

  • Pairwise Transient Key (PTK), used to encrypt unicast communication between AP and client. PTK is derived and installed by the AP and the client at the time of setting up a wireless connection. It is refreshed during the connection after pre-configured time has passed. It is also refreshed when client roams between APs using fast transition (FT) protocol.
  • Group Transient Key (GTK), used for encrypting broadcast and multicast messages from APs to clients. A GTK is generated and maintained by the AP. It is securely delivered by the AP to the client at the time of setting up a wireless connection.
  • Integrity Group Transient Key (IGTK), used for providing integrity for broadcast and multicast management messages (called management frame protection or MFP) transmitted from the AP to the client. IGTK is generated and maintained by the AP. It is securely delivered by the AP to the client at the time of setting up a wireless connection.

The keys (GTK and IGTK) are refreshed when a client leaves the AP and the new keys are distributed to all remaining clients using a protocol called Group Key Handshake.

What is WPA?
Wi-Fi Protected Access (WPA) is a security protocol and security certification system developed by the Wi-Fi Alliance in response to weaknesses found in the previous system, Wired Equivalent Privacy (WEP). This was an intermediate measure taken in anticipation of the availability of the more complex and secure WPA2. WPA is obsolete and insecure, and WatchGuard recommends that all customers use WPA2, and not WPA.

Is there a method to protect patched devices against unpatched devices?
WatchGuard is providing patches for all of our affected products, and for non-WatchGuard appliances, users should refer to their Wi-Fi device vendor’s website or security advisories to determine if their device has been affected and has an update available.


Source: WatchGuard