

Did you know that there are several USB types? Do you know them all?

USB types: the final list to know them all
“Pen drive”, “memory stick”, for those less attentive: “VHS”… We have given many names to what we actually meant by USB. But you have to know that the term goes a little beyond that gadget of four or eight gigabytes that we use for so many things. In fact, there are several USB types, and today we will delve into getting to know them.
USB Types: What is a USB?
First we should make clear that, as many suspected but few dared to inquire, the acronym USB is derived from the corresponding words: Universal Serial Bus. USB is a connection protocol that allows us to connect several peripheral devices to an electronic device to achieve an exchange of data. It can also be useful to carry out some operations or charge the battery of our devices. It is, then, like a port that works as a connection socket between different devices.
The range of devices that we can interconnect to a computer thanks to USB is quite wide. We just have to think a bit so that they all come to our heads immediately. Mouses, keyboards, video and photo cameras, smartphones, USB memories, music players, webcams, speakers, printers, recorders, external hard drives, PDA… There are countless examples.
We owe this protocol to the fruitful 1990s, a wonderful decade for Britpop and for technology. It was seven large technology corporations (Intel, IBM, Northern Telecom, Compaq, Microsoft, NEC and Digital Equipment Corporation) who joined hands to reach an agreement on the peripheral connection standard for a computer. The idea was good for everyone, and although they started with a first model, USB 1.0, different from the current ones, everything was just a matter of evolution.
USB Types: Standards
USB devices are classified into four types based on their data transfer speed: Low Speed (1.0), Full Speed (1.1), High Speed (2.0) and Super High Speed (3.0).
- USB 1.0. It was the one that appeared in the mid-nineties. The maximum speed at which information could be transferred was 1.5 Mbps. Well, it could be used for connecting devices like the mouse and keyboard for example.
- USB 1.1. The transfer rate increased to 12 Mbps.
- USB 2.0. It is undoubtedly the most widespread standard and sends data at a speed of 480 Mbps, although its actual rate is 280 Mbps. In the cable you may find four lines: two for data transfer and two for power.
- USB 3.0. We can consider it about ten times faster than 2.0. It reaches speeds of 4.8 Gbps. The best thing is that it is still compatible with the previous ones and on top of that, it includes five additional contacts. At present, it coexists with 2.0. in perfect harmony.
- USB 3.1 It is the last of the standards. In fact it emerged just a few years ago. It reaches a data transfer speed of 10 Gbps. As an incentive, it comes with a new type of connector, connector C.
USB Types: Types of connectors
Now we go to the shapes of USB, which is why we are more familiar with them.
Type A. It is the one that most users will recognize. That flattened rectangle in which we can see internal connections. The male connector is at the end of the cables, while the female is the port itself.
Type B. The ports and connectors belonging to this type are just as recognizable by users, but somewhat smaller and wider than those of type A. As a general rule, we can find them in devices such as printers.
Type C. The Type-C connector has appeared the same as USB 3.1 and the distinguishing feature is that it is reversible. That’s right, no matter which side you insert, it works both ways.
MiniUSB. You may find two different versions of this one, made by 5 or 8 pins. We can see them in cameras, external hard drives, music players and a few other trinkets.
MicroUSB. The microUSB is the smallest and thinnest of all. It is quite flat and was conceived to connect to our smartphones. With them we can transfer information and charge batteries, so we also know it very well.
USB Types: Mistaking them with USB Memory
As we have seen, the concept of USB refers to the connection port. However, the term “USB” has also been extended to refer to pen drives. Pen drives are enabled with a memory that works as a place for storing and transporting data. It’s the rightful replacement for floppy disks and CDs (who doesn’t have one, for God’s sake?!), with different capacities ranging from 1GB to 1TB. Simply because the pen drive connects through USB, they have ended up calling it that. To shorten it. We are that practical and love saving that much.
Once you just got into the technological ins and outs, are you hungry for more? Would you like to go even further in the world of technology? What about spending a couple of minutes to find out what computing system monitoring is and why it is also very important?
Monitoring systems are responsible for supervising technology (hardware, networks and communications, operating systems or applications, for example) in order to analyze its performance, and to detect and alert about possible errors. And this leads us to Pandora FMS, that wonderful tool thanks to which this blog is possible.
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.


VEGAS Creative Software Embraces New 12th Gen Intel® Core™ Processor as CPU-of-Choice for Optimal Workflow Performance for VEGAS Pro
12th Gen Intel Core Processor Performance Gains, Enhanced CPU+GPU Integration Significantly Boosts VEGAS Pro Workflow Speed and Efficiency
01/05/22
VEGAS Creative Software (www.vegascreativesoftware.com) announced today it has embraced the new 12th Gen Intel® Core™ processor to optimize the workflow and performance of its lineup of video/audio editing, color grading, effects and live streaming software, including VEGAS Pro.
By embracing this new architecture, VEGAS Pro will now benefit from significant single- and multicore performance gains for content creators. All AI/ML-based features in VEGAS Pro are now optimized for the new 12th Gen processor through OpenVINO. Capabilities such as AI-based Upscale, Style Transfer and Colorization will be faster and more efficient.
For additional performance enhancements, VEGAS Pro also takes advantage of the improved GPU + CPU integration with Intel® Deep Link technology, as well as hardware accelerated encoding and decoding of video, offering a smoother workflow and a faster delivery for content creators.
The hybrid processor architecture of 12th Gen Intel® Core™ processors combines larger highperformance cores with smaller high-efficiency cores. The intelligent selection of cores for different levels of tasks is handled automatically by the Intel® Thread Director, supported by Windows 11. These capabilities are at the heart of many of the stunning, AI-powered effects built into VEGAS Pro.
Hagen Hirche, chief technology officer for MAGIX and VEGAS Creative Software commented: “The combination of VEGAS Pro, the 12th Gen Intel Core processor and Win 11 is something for our users to celebrate. With the launch of this new processor, Intel has provided a great leap forward in multicore performance and gives mobile devices desktop-like performance which in turn means our users can get more done in less time.”
Jerry Tsao, GM and VP of Client Computing Group MCP Enthusiast Segment at Intel: “This close collaboration by our engineers utilizing Intel® OpenVINO toolkit and Intel® Deep Link technology, enables an AI-rich and performance-optimized video editing experience when running VEGAS Pro on 12thth Gen Intel® Core™ H- Series processors, which will make creators more productive and help unlock their creativity.”
About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About VEGAS
Today, millions of VEGAS Pro and VEGAS Movie Studio users benefit from global industry-leading video editing technologies. Now, VEGAS launches into a new era. In May, 2016, MAGIX acquired the multiple award-winning VEGAS Pro and VEGAS Movie Studio product lines, along with other video and audio products. VEGAS Creative Software stands poised to take video editing to a new level. Our development teams in the US and Germany are working on innovative solutions to old problems, and building tools that push the boundaries of what’s currently possible. The VEGAS Creative Software mission: to make VEGAS software faster, more efficient, and even more intuitive. Our goal: to provide users at all levels–from video editing amateurs to creative professionals–tools that are perfectly suited to their needs and demands.


The Log4j Vulnerability Spells Crisis for Network Security, With Some Exceptions

In early December 2021, a significant vulnerability in a common piece of Java-based code by Apache set the world on fire…at least for IT security professionals. Within 24 hours of disclosure, leading software companies like IBM, Oracle, Amazon, and Cisco went into damage control, seeking to assess the level of potential damage they had and could expect to sustain, and frantically working on patches to prevent their customers’ data from being siphoned off and sold to the highest bidder. The event was fitting for 2021, a year marked by disinformation, confusion and fear.
“The log4j vulnerability is the most serious vulnerability I have seen in my decades-long career,” Jen Easterly, U.S. Cybersecurity and Infrastructure Security Agency director, said in a interview on CNBC.
As December 2021 dragged on, related flaws continued to surface, sending those same software companies back to the drawing board to repackage and test yet another series of patches for customer distribution. This after communicating initial patches to customers that often took a whole weekend or more to implement. It didn’t bode well for a happy holiday season for already resource-strapped IT teams who had been dealing with a plethora of network security issues for two years brought on by the COVID-19 pandemic and the overnight surge of remote workforces.
Depending on the version and the type of application, the log4j vulnerability’s scope and severity ranged from focused and moderate to widespread and critical. Some vendors were hit harder than others, such as Cisco, whose Identity Services Engine system saw more than 120 configurations affected. Others, like Microsoft, capitalized on the opportunity, rolling out solutions to proactively seek out and manage affected files, software, and devices impacted by log4j.
Widespread & Hard to Pin Down
The extent of the impact of the log4j vulnerability was in many ways foreseeable. The root cause: human “ingenuity” that could otherwise be called laziness. Rather than reinventing the wheel by creating a new set of code for each application that is developed, software engineers now often patch together existing libraries and packages for shared functions to generate much of the codebase that runs critical applications.
Like many noteworthy cyber incidents before it, the Log4j vulnerability helped us open our eyes to just how many software dependencies exist across enterprise systems — no matter if they are designed for security, operations, or sales. It also highlighted to us just how hard it is to mitigate and develop stopgaps for these vulnerabilities when they are so far-reaching and barely understood, especially in the early days of disclosure.
While the ability to utilize the same code across many systems does offer value in terms of time to market, the problem is that many prefabricated libraries and open-source projects are interdependent, resulting in a web of dependencies that drill down many layers. Inevitably, this creates a scenario where indirect dependencies that can be nearly impossible to identify and troubleshoot when a vulnerability is unearthed.
For the average Joe IT manager, this just means that the software you licensed was likely built using common third-party code you’re not even aware of that likely contains some vulnerabilities. Multiply this shared code across other enterprise systems in your stack – and queue the headaches.
Avoiding Issues Like Log4j as an End-User
Java is a programming language that’s been around for a while and is commonly found in older on-premises software. As such, it should not come as a surprise that the classic tech giants of the world wasted no time prioritizing the log4j vulnerability – they had billions of dollars in revenue at stake across their suites of legacy software. And to make matters worse, the issue didn’t just impact Java-based systems, but also Java components and development frameworks that rely on it including Apache Struts2, Apache Solr, Apache Druid, Apache Flink, ElasticSearch, Apache Kafka and many others. We’re talking about tens of millions of impacted systems in use at any given moment today.
How to avoid such widespread vulnerabilities is more than a question of choosing which apps are programmed with which language(s) – software engineers can debate the efficacy of each until they are blue in the face. Rather, it’s a question of how to consume enterprise software. For organizations more reliant on cloud native software-as-a service applications, IT employees almost certainly experienced fewer lost weekends dealing with the log4j problem.
This is because SaaS has a shared responsibility model, whereby both the vendor and the customer are responsible for the security of the application in use. The onus is on the SaaS vendor to deliver secure products and services, while the responsibility for configuring, managing, and using the product lies with the customer. In the case of Log4j, most of the heavy lifting falls on the SaaS vendor. They must ensure that their products are not affected. If they are, it is up to them to provide transparency into how the system is being patched and how the vulnerability is being mitigated.
While this differentiation seems simple, implementing a cloud-first IT strategy – no matter if universal or by function – can mean retaining IT talent by avoiding burnout, optimizing your IT budget by eliminating the need for third-party professional services, and so much more.
About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。


Actiphy Releases ActiveImage Protector 2022 Backup and Recovery Solution Featuring Direct-To-Cloud Backup and In-Cloud Recovery
Wildomar, CA — November 12, 2021, Actiphy Inc., a leading publisher of backup, disaster recovery, and virtualization software, announces the release of ActiveImage Protector 2022 featuring direct-to-cloud backup, in-cloud recovery, and a new agentless and agent-based hybrid licensing option.
This new version can now backup and restore directly to and from public cloud services and SFTP servers. With new In-Cloud Recovery, backup images can be restored as VMs in the cloud environment. New LTO Tape Support provides high speed backup of bulk data to high capacity tape storage solutions to ensure long-term archival stability. Point-in-time file and folder backup, a frequently requested feature, has been included in this release.
ActiveImage Protector 2022. On-Premise Strong, Cloud Stronger.
New Features
- Direct-To-Cloud Backup
Backup systems directly to cloud storage. Supported public cloud storage services include Amazon S3 and Azure as backup destinations. In addition, Direct-To-Cloud Backup also supports SFTP servers as backup destinations.
- In-Cloud Recovery
Any backup image can be restored directly to a virtual machine within the same cloud environment. In-Cloud Recovery offers an easy system migration of on-premise virtual or physical machines directly to cloud environments.
- Actiphy Portal Service (APS)
A powerful new on-line monitoring portal designed for Managed Service Providers (MSP), distributors and resellers. APS provides monitoring ActiveImage Protector (AIP) clients, collecting backup logs and generating reports of AIP clients’ task status.
- LTO Tape Support
Support for LTO as a backup destination. Backup data saved on tape can be physically isolated from ransomware attacks and ensures long-term archival stability.
- File Backup
A new file backup option providing granular point-in-time backup and restore of specific files and folders.
- RescueBoot
Adds an optional boot recovery environment to the system boot menu.
- Disk-To-Disk Copy
A new disk-to-disk copy option that supports virtual disks, physical disks, and volumes, for a complete sector by sector copy.
- Offline Environment Activation Support
With Actiphy Authentication Service (AAS) or a license file, ActiveImage Protector agents can be activated in an off-line environment.
- iSCSI Target Server
Utilize iSCSI targets and NFS exports to emulate backup images as virtual disk files for flexible and immediate recovery or migration.
- Subscription License
Annual, three-year, five-year subscription and perpetual licenses are now available.
- Hybrid Licensing for Server Edition
Selectable Agent-based or Agentless Backup licensing is now available for server edition.
- Additional Linux Distributions Support
ActiveImage Protector Linux edition now supports Ubuntu 18.04 LTS and 20.04 LTS, Debian 9/10/11, RedHat 8.4, Rocky Linux 8, Alma Linux 8 and Amazon Linux 2.
ActiveImage Protector 2022 is a backup and recovery solution that protects physical and virtual, Windows and Linux environments. The AIP solution includes all the tools necessary for enterprise level deployment and management of backup, recovery, standby switch-over, and migration.
Copyright © 2021 Actiphy, Inc. All rights reserved worldwide. All other brands and product names mentioned in this news release are trademarks or registered trademarks of their respective holders.
About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About Actiphy
Actiphy founded in 2007, focuses on developing and offering innovative backup and disaster recovery solutions for complete protection of all your systems and data. ActiveImage Protector backs up Windows, Linux machines on physical and virtual environments and restore systems and data fast for you to be up and running with minimal downtime and data loss. Today Actiphy hold 20% of the image backup market in Japan and are expanding our services in the Asia/Pacific and North American regions, as well as in Europe, the Middle East and Africa.


Privileged Access Management

Implementing privileged access management in a company is critical to ensuring that there are no information theft and other security issues.
The so-called cyberattacks are responsible, for example, for the theft and hijacking of information in exchange for money, causing several damages to the continuity of an organization’s business. They have become very common and their actions can cause not only financial losses but also image and reputation losses.
Unfortunately, the trend is that over the years, these cyberattacks will become more and more severe and that their number of occurrences will grow.
With this scenario, the importance of privileged access management also grows. Cyberattacks happen through classic malware and phishing methods or the exploitation of zero-day software vulnerabilities, in addition to advanced social engineering techniques.
With all that, privileged access management comes to help ensure that organizations function. Thus, it covers the need to protect data, networks, and devices from malicious actions.
Gartner, in its document Gartner Top 10 Security Projects, named Privileged Access Management (PAM) as the number one priority in security projects. So, what does Privileged Access Management mean and why is it considered so important? That is what we are going to talk about today.
What is Privileged Access?
Before explaining what Privileged Access Management is, we need to understand what privileged access or credential is.
All the time, malicious people appear looking for flaws within the companies’ systems to gain access to confidential data. This threat can be both external and internal. Therefore, organizations are increasingly looking for solutions that are truly capable of protecting this information.
Privileged accounts are created to control access to this data. This access is usually restricted only to people who hold leadership positions (high-level management) and administrators in the IT area. Other employees can obtain this information with the authorization of the company.
Through privileged credentials, significant changes can be made to devices and applications installed on an infrastructure, which in many cases can affect business continuity. The impact of using them maliciously can cause serious damage, from violations of compliance items, which can lead to heavy penalties, to security incidents – which result in reduced trust by the interested parties and lost revenue.
Although it is extremely important, proper control often ends up being flawed. Hence the need to have a tool really capable of directing, tracking, and filtering these accesses. Among the most efficient, we have PAM solutions.
What is a Privileged Access Management (PAM) solution?
Privileged Access Management, also called Privileged Identity Management, enables organizations to protect their privileged credentials. In addition, PAM also ensures the effectiveness of least privilege policies by reducing attack vectors and possible data leaks.
Gartner believes that a PAM solution helps organizations securely provide privileged access to critical assets and meet compliance requirements by managing and monitoring privileged access and accounts.
Basically, a PAM solution works as a secure credential repository for devices installed in the environment. Based on the management of user privileges, one can allow users to access only the data required for them to perform their activities. Thus, the information security team can configure user access profiles, avoiding improper access to systems and data.
What is the Principle of Least Privilege?
The principle of least privilege is one of the bases for information security. Its main goal is to grant users access to environments that are required for them to perform their tasks. In other words, with the principle of least privilege, users do not access environments they do not require, avoiding internal threats, data leaks, and hacker infiltration in critical environments of a company.
Through the senhasegura solution, you have several security locks that ensure users access only the environments required by them. Besides monitoring the way the user is performing privileged access, the senhasegura solution registers, records, and notifies those responsible for information security about any malicious activity within the privileged session.
Through this simple practice, they significantly minimize the chances of a cybercriminal accessing sensitive company data and extracting information.
How is Privileged Access Done?
Privileged access to devices can be performed in two ways: manually (least recommended); and through specific Privileged Access Management (PAM) solutions. In this second case, PAM controls administrative access to a company’s critical systems to help it achieve its cybersecurity goals.
Controlling privileged actions allows one to protect a company’s IT systems against any attempt to carry out malicious actions, such as improper changes in the environment and theft of information. These blocked actions can take place both inside and outside the company.
In this context, using privileged access management technology is essential to optimize the deployment of a cybersecurity infrastructure in companies.
Moreover, the need for effective use of privileged access management techniques has never been greater, as traditional defense mechanisms such as antivirus, VPNs, and firewalls are subject to many failures today.
Thus, a PAM solution should be able to:
- Allow a company to set several flexible parameters for privileged access control, such as window access, access restrictions for specific users or systems, or access limitation to resources required to perform a task;
- Be a single repository of administrative credentials across all systems and environments within an organization, resulting in reduced audit time and incident investigations;
- Link role-based user control to critical systems, applications, and services, thus allowing the connection between a privileged user and an individual, which improves granularity of control and visibility;
- Provide a scalable, searchable, and comprehensive audit and reporting solution for user activities on critical systems, with the ability to view commands and sessions on those systems.
- Centralize privilege visibility and control across a single management, policy, and reporting platform for all devices and users, resulting in increased efficiency and unification of the management approach across the environment.
- Integrate auditing activities for user tasks such as Syslog with other monitoring and reporting technologies such as SIEM (Security Information and Event Management).
- Strengthen the policies of least privilege for granular control of administrative rights, while facilitating elevation of privileges without the need to assign administrator or root access.
- Escalate management of all credentials across a range of operating systems and platforms.
Through an architecture that requires no agent installation, senhasegura offers a centralized access point for critical systems. Its features allow strengthening the access control, limiting the user access only to what was previously authorized, respecting the principle of least privilege.
Thus, senhasegura offers full visibility of who has access to these systems and what actions have been taken with the privileged credentials.
Some features of senhasegura include:
Credential Management
Allows secure password storage and centralized access management. From the definition of Access Groups for segregation of roles, one can configure pre-approved or emergency access, or start from workflows with single or multiple approvals, without the user having access to the credential password.
Session Recording
Allows tracking of any action taken during a privileged session to meet any audit or data privacy authority’s demand. In addition, the livestream feature allows real-time monitoring of ongoing sessions and the possibility of remotely ending a session;
Application Identity
senhasegura uses its own template for changing the password of application credentials and stores the new encrypted password in its database. The credential can be viewed directly by the solution’s connection API or inserted directly into the application server connection pool.
When used to manage privileged access on organizational systems and platforms that store or protect the integrity of sensitive data, senhasegura provides a centralized access point for critical systems. Its features allow strengthening the access control, limiting the user access only to what was previously authorized, respecting the principle of least privilege.
Thus, senhasegura offers full visibility of who has access to these systems and what actions have been taken with the privileged credentials. Finally, control and visibility on privileged actions are key factors for an organization to comply with a range of regulatory requirements for system protection. This ensures compliance and business continuity.
About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About Segura®
Segura® strive to ensure the sovereignty of companies over actions and privileged information. To this end, we work against data theft through traceability of administrator actions on networks, servers, databases and a multitude of devices. In addition, we pursue compliance with auditing requirements and the most demanding standards, including PCI DSS, Sarbanes-Oxley, ISO 27001 and HIPAA.


ESET’s research into “Bring Your Own Vulnerable Driver” details attacks on drivers in Windows’ core Next story
- The in-depth blogpost provides an in-depth look at vulnerabilities in kernel (the central component of the Windows operating system) drivers.
- Vulnerabilities in signed drivers are mostly utilized by game cheat developers to circumvent anti-cheat mechanisms, but they have also been used by several APT groups and in commodity malware.
- Delivering a vulnerable signed kernel driver is a popular option for attackers – this technique is called Bring Your Own Vulnerable Driver (BYOVD).
- This technique was utilized by the Slingshot and InvisiMole APT groups, the RobbinHood ransomware family, and LoJax, the first-ever UEFI rootkit used in the wild.
- ESET researchers have discovered vulnerabilities in three drivers.
- The blogpost details mitigation techniques.
BRATISLAVA, PRAGUE — January 11, 2022 — ESET Research has released an in-depth blogpost offering an in-depth look into the abuse of vulnerable kernel drivers. Vulnerabilities in signed drivers are mostly utilized by game cheat developers to circumvent anti-cheat mechanisms, but they have also been observed being used by several APT groups and in commodity malware. The blogpost discusses the types of vulnerabilities that commonly occur in kernel drivers, provides several case studies of malware utilizing such vulnerable drivers, analyzes examples of vulnerable drivers discovered during our research, and outlines effective mitigation techniques against this type of exploitation. These drivers can often become unguarded gateways to Windows’ core for malicious actors.
Among the various types of kernel (the central component of the Windows operating system) drivers are “software” drivers that provide specific, non-hardware related features like software debugging and diagnostics, system analysis, etc. These are prone to extend the attack surface significantly. Although directly loading a malicious, unsigned driver is no longer possible in the newer versions of Windows, and kernel rootkits are considered to be a thing of the past, there are still ways to load malicious code into the kernel, especially by abusing legitimate, signed drivers. Indeed, there are many drivers from various hardware and software vendors available that offer functionality to fully access the kernel with minimal effort.
The vulnerabilities most frequently observed in kernel drivers include:
- failures to add checks that restrict read and write access to critical model-specific registers (MSRs);
- exposing the ability to map physical memory from user mode for reading and writing; and
- exposing the ability to access virtual kernel memory from user mode for reading and writing.
“When malware actors need to run malicious code in the Windows kernel on x64 systems with driver signature enforcement in place, carrying a vulnerable signed kernel driver seems to be a viable option for doing so. This technique is known as Bring Your Own Vulnerable Driver, abbreviated as BYOVD, and has been observed being used in the wild by both high-profile APT actors and in commodity malware,” explains Peter Kálnai, one of the co-investigators of this research.
Examples of malicious actors using the BYOVD technique include the Slingshot APT group, which implemented their main module, called Cahnadr, as a kernel-mode driver that can be loaded by vulnerable signed kernel drivers. Another example is the InvisiMole APT group, which was uncovered by ESET researchers in 2018. A newer variant of the InvisiMole malware is the only case to date that ESET has observed of MSR exploitation on Windows 10 x64 systems being used in the wild by a malicious actor.
Yet another example is the RobbinHood ransomware which, as commodity malware, aims to reach as many people as possible. Thus, seeing it use a BYOVD technique is rare but powerful. This ransomware leverages a vulnerable GIGABYTE motherboard driver to disable driver signature enforcement and install its own malicious driver. Finally, LoJax, another ESET discovery in 2018 and the first-ever UEFI rootkit used in the wild, used the RWEverything driver to gain access to victims’ UEFI modules.
ESET researchers not only catalogued existing vulnerabilities, but also looked for new ones — a full list of the discovered vulnerabilities can be found in the published in-depth blogpost. The vendors that ESET contacted were very proactive during the disclosure process and eager to fix the uncovered vulnerabilities.
“Although there are several mechanisms employed by the CPU and/or the operating system, most of them can be bypassed with some clever techniques and are not very effective if the attacker prepares for them ahead of time,” says Kálnai.
The blogpost offers the following useful mitigation techniques:
- Virtualization-based security: This is a feature introduced in Windows 10 that leverages hardware virtualization to place the kernel in a sandbox thus securing the operating system with various protections.
- Certificate revocation: On modern Windows systems, drivers need to have a valid signature based on an “acceptable” certificate. Hence, revoking the certificate of a vulnerable driver would be an easy way to “disarm” it and render it useless in most cases.
- Driver blocklisting: This is a practice adopted by both Microsoft and various third-party security product vendors, including ESET, to detect and delete the most notorious vulnerable drivers when found on a system.
For more technical details about vulnerable signed kernel drivers, read the blogpost “Signed kernel drivers – Unguarded gateway to Windows’ core” on WeLiveSecurity. Make sure to follow ESET Research on Twitter for the latest news from ESET Research.
About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.


What is actually a hacker?

What is a hacker? More like Mr. Robot rather than Operation Swordfish
If we lived in a fair and more appealing world, children would not want to be Cristiano Ronaldo or PewDiePie (popular Swedish youtuber that if you have a certain age, or dignity, you won’t know about). Children would like to be someone with values, like Immanuel Kant, She-Ra or, of course, a high-level hacker who, from the sewers of a suburban pavilion, controls the world with his killer laptop and his hoodie.
We get the idea of Immanuel or She-Ra, but why do we keep that idea in our head that hackers are so cool? What is a hacker seen through the eyes of someone who knows what this world is all about? It is not that we have brought to the fore a real hacker to solve it -authorities stay calm-, but we have brought Kevin Rojas, a project consultant at Pandora FMS and a renowned technologist and nerd of these things.
What is actually a hacker?
A hacker is a person who knows a lot about computing (security, networks, programming) and uses his knowledge to detect security flaws in the computer systems of companies or organizations.
What exactly do they do?
There are different types of hackers depending on what they do and how they do it, although it could be simplified into “good hackers” and “bad hackers”. The “good guys” (ethical hackers or “white hats”) are usually hired by companies to help them improve the system security by plugging holes and fixing bugs, and the “bad guys” (“black hats”) take advantage of those holes and mistakes for personal profit. Then there are all sorts of intermediate points, such as “gray hats”, who look for faults in business systems… to attempt to be hired to help them solve them.
Why do you think they are so romanticized by movies?
I guess because of the growing importance of computing and how “appealing” it sounds to be able to break into any kind of security. In the end, a hacker is someone who gets away with anything by being “more resourceful.” Who doesn’t like big hit movies?
In addition, a hacker does not obey to any physical pattern: it does not matter whether a person is tall or short, fat or skinny, it does not matter if that person is extroverted or what his economic level is. Anyone with enough wit (and knowledge) could be a hacker… and it’s no small feat.
What things do they usually do?
A real hacker could spend a lot of time studying (really, a lot). They have to know how things work, how elements interact, what known errors different technologies have, what the most effective security policies are and what the most common errors that users make are (which, by the way, are usually the chain’s weakest link: Have you seen those people who write down the password of their user in a post-it stuck to the screen?).
What they also usually do is a lot of programming. They create malware that takes advantage of system vulnerabilities, or that captures the keystrokes and mouse keys of careless users who install programs from suspicious web pages.
They do a lot of things, but there’s one I guarantee they don’t usually do: program “detailed 3D graphical interfaces with countdowns that light up the screen red while a submarine alarm beeps when the system recognizes a security breach and activates the countermeasures”. They don’t do that, even though you may have seen it in movies like Skyfall.
What do you think are the biggest differences between a real hacker and a cliché movie hacker?
Movie hackers often hacking into systems “just like that”. “Give me any computer with Internet access and in 10 minutes I’ll be connected to the Ministry of Defense network.” Well no, it is way more complex than that and it takes much more work behind. It’s more like Mr. Robot rather than Operation Swordfish. Not that much glamour and a lot of black screen with Linux terminals.
Could you name a real hacker who has gone down in computer history for his misdeeds? What did he do?
We do not have to go that far: Swedish Julian Assange, for example, went down in history in 2010 (and on the lists of most wanted people in the United States) for leaking documents from the American intelligence service regarding several incidents that took place in the war against Afghanistan.
Also the group Anonymous is currently quite a hot topic, which is not a single person but a large group of hackers, who have been leaking information since 2003 and from which the aforementioned series, Mr. Robot was inspired.
But not all famous hackers are bad guys: there are also famous ethical hackers like Chema Alonso, Telefónica’s current CDCO, one of the heads involved in managing of the 2017 Wannacry crisis, which, in case you don’t remember, was caused by a program that encrypted the code and data of infected computers, and asked for money to recover them. We need hackers to deal with hackers…
About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.


5 Edge Computing Predictions for 2022
It’s that time of year again where we look into our crystal ball and issue our prognostications for the year ahead for what we think the future of the edge computing marketplace might have in store. To compile this list, we canvassed our in-house experts and consulted with customers and partners about the trends they see shaping the edge marketplace in 2022.
1. Edge computing will unite IT and OT to drive industrial transformation
Industries like manufacturing rely upon a variety of operational technologies (OT) systems to monitor and control devices and workflows in their environment — everything from simple temperature sensors to advanced industrial control systems. As these old school industries begin to fully embrace IIoT devices, they must figure out how to leverage all of the data that these systems generate without burdening their existing networks. As Rob High of IBM noted in our recent Spiceworks video meetup, “most IoT equipment these days now includes some kind of general purpose compute embedded in the device itself – we’re seeing this with everything from cameras to industrial robots.” Edge computing enables data to be collected and processed closer to where it’s being generated so it can be immediately put to use. Scale Customers like Harrison Steel are using edge-based systems today on the factory floor, collecting data thousands of times per second to keep their precision machinery properly calibrated. We have no doubt that the coming year will see this trend accelerate further as other industries embrace edge systems so they can bridge the IT/OT gap.
2. New applications and use cases will fuel adoption of edge computing
Practically overnight, the global pandemic shifted how we work and businesses had to quickly adapt to connect their remote workforce to the applications they rely on to stay productive. If we learned anything from this experience, it’s that where applications are hosted matters a lot. In response, we’ve seen an influx of new hybrid-based computing models such as metro-based data centers that have been built in close proximity to where businesses and users live. As a result, forward-thinking IT leaders are taking a more thoughtful approach to their application portfolio by considering the trade-offs of latency, network throughput, resiliency and privacy issues. As new use cases and applications emerge, we anticipate that new hybrid edge models will evolve alongside of them that promise greater flexibility and resilience.
3. Orchestrated edge systems will become a viable public cloud alternative
Public cloud services such as AWS, Azure and GCP have completely transformed how IT services are managed and delivered. As Scale Computing’s founder Jeff Ready is fond of saying, “the cloud just means someone else’s data center” and while the cloud certainly has its advantages, it’s not without its shortcomings. Which is why we are poised to see new paradigms emerge by which businesses can essentially build their own systems with similar capabilities of public cloud infrastructure, but intended to be run at the edge of the network. By clustering together fleets of autonomously managed edge computing platforms and distributing them close to where users live, organizations will be able to benefit from cloud-like convenience without having to compromise on performance.
4. Edge innovations such as zero touch provisioning will ease the IT staffing crisis
According to a recent Gartner report, businesses think that talent shortage is the biggest barrier to the adoption of 64% of new technologies, compared to just 4% in 2020. This means that in many cases, IT leaders hoping to deploy a new technology solution might choose to instead delay an important initiative until they have the requisite skilled IT resources in place. But what if you didn’t need to have dedicated IT staff at every remote or branch office location to keep the IT ship upright? Zero touch provisioning, which enables a centralized IT staff to remotely deploy and manage their edge-based systems from a single console, promises to be a game changer in enabling resource-strapped organizations to remotely administer their systems without having to hire additional specialized IT workers.
5. Edge-enabled computer vision will create new opportunities beyond surveillance
Digital video surveillance systems are another aspect of operational technology that live primarily at the network edge. These systems generate massive amounts of data that typically require localized infrastructure due to bandwidth constraints. While most of these systems are used primarily for surveillance and loss prevention today, we expect to see a number of industries — most notably in the retail and manufacturing sectors — begin to layer AI-based computer vision technologies on top of these systems to deliver new capabilities that will improve their operational efficiency and responsiveness. From applying computer vision to track inventory in real-time to using video analytics to generate visual heatmaps to enhance the in-store shopping experience, these types of innovations will require a fast and flexible edge-based infrastructure to realize their full potential.
While no one can say with any certainty what the future will bring, the one thing that we can count on is that for businesses to thrive, they will need to embrace technologies that will enable them to quickly adapt to changing market conditions. To see how edge computing can help you better prepare for an uncertain future, learn more about how Scale Computing is enabling the next generation of edge computing by downloading this informative Gorilla Guide.
About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About Scale Computing
Scale Computing is a leader in edge computing, virtualization, and hyperconverged solutions. Scale Computing HC3 software eliminates the need for traditional virtualization software, disaster recovery software, servers, and shared storage, replacing these with a fully integrated, highly available system for running applications. Using patented HyperCore™ technology, the HC3 self-healing platform automatically identifies, mitigates, and corrects infrastructure problems in real-time, enabling applications to achieve maximum uptime. When ease-of-use, high availability, and TCO matter, Scale Computing HC3 is the ideal infrastructure platform. Read what our customers have to say on Gartner Peer Insights, Spiceworks, TechValidate and TrustRadius.


Zendesk Plugin: New integration incorporated to Pandora FMS

It is always a luxury to show off a new plugin in Pandora FMS, and for that reason we decided to devote an article in style to this Zendesk plugin on our blog. We will discuss what it is and how it can help us. Step by step, and concisely, so that no one gets lost along the way.
New Zendesk plugin added to Pandora FMS
But first: What is Zendesk?
Zendesk is a platform that channels the different communication modes between customer and company through a ticketing system.
A consolidated CRM company, devoted specifically to customer service, which designs software to improve relationships with users. Known for growing and innovating while building bonds and putting down roots in the communities where it lives. Its software, such as Pandora FMS, is very advanced and flexible, being able to adapt to the needs of any growing business.
Zendesk plugin
The plugin we are talking about today allows you to create, update and delete Zendesk tickets from the terminal, or from Pandora FMS console. For that, it makes use of the API of the service, which allows this system to be integrated into other platforms. Using a series of parameters, which would be the configurable options of the ticket, you may customize them as if you were working from Zendesk itself.
Zendesk Ticket System
Zendesk has an integrated ticketing system, with which you may track support tickets, prioritize them and resolve them.
To the point: System configuration to use the plugin.
To make use of the plugin, enable access to the API, either using password or token.
Do it from the API section in the administrator menu.
Plugin parameters
The plugin makes use of a number of parameters when creating, updating or deleting tickets. With them you may configure the ticket according to your own criteria and needs. Just as you would do it from Zendesk’s own system.
Method
-m
With this option you will choose whether to create, update or delete the ticket. Use post to create it, put to update it, and delete to delete it.
IP or hostname
-i
With this alternative you may add the ip or name of your site. Sites usually have this format:
“https://<nombre>.zendesk.com
For example, mine is https://pandoraplugin.zendesk.com/. So, in this case, it should be pandoraplugin.
* If the full url is placed, it will not work.
User
-us
Your username. Usually the email with which you signed up in Zendesk. Use this option, combined with password or token, depending on how you have it enabled.
Password
-p
The password to authenticate with the API.
Token
-t
The token to authenticate to the API. If you use this option, you do not have to use the password option.
Ticket name
-tn
The name to be given to the ticket.
Ticket content
-tb
Ticket text. It should be enclosed in quotation marks.
Ticket ID
-id
Ticket ID. This option is for when you want to update or delete a ticket.
Ticket status
-ts
The status of the ticket, which can be new, open, hold, pending, solved or closed.
Priority
-tp
The priority of the ticket, which can be urgent, high, normal or low.
Type
-tt
The ticket type, which can be problem, incident, question or task.
Ticket creation
By running the plugin with the appropriate parameters you may create tickets:
python3 pandora_zendesk.py -m post -i <ip or site name> -us <user> -t <token> -tn <ticket name> -tb <ticket content> -tp <priority> -tt <type> -ts <ticket status>
Example
With the following command:
python3 pandora_zendesk.py -m post -i pandoraplugin -us alejandro.sanchez@pandorafms.com -t <token> -tn "Problem with X" -tb "Something is giving some problem" -tp urgent -tt task -ts new
Interact with the API and the ticket will be created in your system.

Ticket update
You may update the tickets. The parameters are the same as in creation, but you have to add also the id, which will be the id of the ticket to be updated.
python3 pandora_zendesk.py -m put -i <ip or site name> -us <user> -t <token> -id <id ticket> -tn <ticket name> -tb <ticket content> -tp <priority> -tt <type> -ts <ticket status>
Example:
Let’s update the ticket we created in the example above, which has id #24
With the following command:
We see that the ticket has been updated and moved to pending tickets.

Ticket deletion
You may also delete a ticket by searching it by its ID with the following command:
python3 pandora_zendesk.py -m delete -i <ip o host> -us <user> -t <token> -id <id ticket>
Use of the plugin from Pandora FMS console
You will be able to execute the plugin from the console, by means of an alert, which will make the use of the plugin easier.
To that end, go to the menu Commands in alerts:
Inside, create a new command that you will use to create alerts. To achieve this, run the plugin by entering its path and use a macro for each of the parameters used to create a ticket.
Add the description to each of these macros:
Once the command is saved, create an action to which assign this created command:
In each field below (the one of each macro where you have added a description when creating the command), add the value that you would have added to the parameter.
Once you have filled in all the fields of the necessary parameters, click Create.
Once done, go to List of alerts (don’t worry, once configured, you won’t have to repeat the process for each ticket you want to create), and create one.
Designate an agent and a module (it does not matter which one), and assign the action you just created. In the template, set the manual alert.
Once completed, click Add alert.
Now, to run the plugin, go to the view of the agent that you assigned to the alert and you will see it there. You may execute it by clicking the icon Force.

To establish different tickets, go to the action you created and change the values of the fields.
Just as we generated an alert for ticket creation, you may make another to update them and another to delete them to allow the use of the optimized plugin.
More integrations in ticketing services
Apart from Zendesk, there are more ticketing services that can be used from Pandora FMS by using a plugin. These are Redmine and Zammad, which have new plugins with which to create, update and delete tickets in these systems. And Jira and OTRS, which also have a plugin in the library that allows you to use these services easily from Pandora FMS.
Resources cursos:
About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.




