A software company supporting hundreds of clinical trials — including coronavirus vaccine trials — has been hit by a ransomware attack that "has slowed some of those trials over the past two weeks," reports the New York Times.

Employees "discovered that they were locked out of their data by ransomware..." eResearchTechnology (ERT) said clinical trial patients were never at risk, but customers said the attack forced trial researchers to track their patients with pen and paper. Among those hit were IQVIA, the contract research organization helping manage AstraZeneca's Covid vaccine trial, and Bristol Myers Squibb, the drugmaker leading a consortium of companies to develop a quick test for the virus. ERT has not said how many clinical trials were affected, but its software is used in drug trials across Europe, Asia and North America. It was used in three-quarters of trials that led to drug approvals by the Food and Drug Administration last year, according to its website.

On Friday, Drew Bustos, ERT's vice president of marketing, confirmed that ransomware had seized its systems on September 20. As a precaution, Mr. Bustos said, the company took its systems offline that day, called in outside cybersecurity experts and notified the Federal Bureau of Investigation. "Nobody feels great about these experiences, but this has been contained," Mr. Bustos said. He added that ERT was starting to bring its systems back online on Friday and planned to bring remaining systems online over the coming days...

One of ERT's clients, IQVIA, said it had been able to limit problems because it had backed up its data. Bristol Myers Squibb also said the impact of the attack had been limited, but other ERT customers had to move their clinical trials to move to pen and paper.
The Times notes it's just one of "more than a thousand ransomware attacks on American cities, counties and hospitals over the past 18 months." Other interesting details from the article:

• ERT's vice president of marketing "declined to say whether the company paid its extortionists, as so many companies hit by ransomware now do."

• The attack follows what NBC News calls "one of the largest medical cyberattacks in United States history," taking down the computer systems of Universal Health Services at over 400 locations.

• "In May, the FBI and the Department of Homeland Security warned that Chinese government spies were actively trying to steal American clinical research through cybertheft... More than a dozen countries have redeployed military and intelligence hackers to glean what they can about other nations' responses, according to security researchers."

• Two companies working on a coronavirus vaccine — Pfizer and Johnson & Johnson — emphasized to the Times that they weren't affected by ERT's issues, with a Pfizer spokesperson stressing they're not even using ERT's software.

"Hello Chrome OS Community," posted one of Google's community managers Wednesday. "Thank you for raising this issue, and for your patience as we work to resolve this. Our team has identified the issue and is rolling out a fix to affected devices."

The issue? ChromeOS users reported the latest updates "cause a Google Play Store service to utilize 100 percent of their CPUs..." according to TechRadar, "making their devices hot and leading to performance issues." As reported by BleepingComputer, after upgrading their devices to ChromeOS version 85.0.4183.108 and later users have faced a number of issues including apps that are running erratically, devices getting hot, fans running at high speed and batteries draining much too quickly. Upon investigating these issues further, users discovered that they were caused by the Google Play 'com.android.vending:download_service' utilizing 95 to 100 percent of their devices CPU for an extended period. This service is used to download new updates from the Google Play Store when they become available. However, a bug in the service causes the CPU to run at 100 percent power all of the time even when a new update is not available.
Bleeping Computer reported last Sunday that the issues didn't affect all Chromebooks, but was reported by users of Acer Chromebooks, ASUS Chromebook Flip, and Galaxy Chromebooks. "One user stated they resolved this issue by rolling back to an older Google Play Store version."

"Google is hiring to create a special Android security team that will be tasked with finding vulnerabilities in highly sensitive apps on the Google Play Store," reports ZDNet: "As a Security Engineering Manager in Android Security... Your team will perform application security assessments against highly sensitive, third party Android apps on Google Play, working to identify vulnerabilities and provide remediation guidance to impacted application developers," reads a new Google job listing posted on Wednesday.

Applications that this new team will focus on include the likes of COVID-19 contact tracing apps and election-related applications, with others to follow, according to Sebastian Porst, Software Engineering Manager for Google Play Protect.

Grindr, one of the world's largest dating and social networking apps for gay, bi, trans, and queer people, has fixed a security vulnerability that allowed anyone to hijack and take control of any user's account using only their email address. TechCrunch reports: Wassime Bouimadaghene, a French security researcher, found the vulnerability and reported the issue to Grindr. When he didn't hear back, Bouimadaghene shared details of the vulnerability with security expert Troy Hunt to help. The vulnerability was fixed a short time later. Bouimadaghene found the vulnerability in how the app handles account password resets.

To reset a password, Grindr sends the user an email with a clickable link containing an account password reset token. Once clicked, the user can change their password and is allowed back into their account. But Bouimadaghene found that Grindr's password reset page was leaking password reset tokens to the browser. That meant anyone could trigger the password reset who had knowledge of a user's registered email address, and collect the password reset token from the browser if they knew where to look.

The clickable link that Grindr generates for a password reset is formatted the same way, meaning a malicious user could easily craft their own clickable password reset link -- the same link that was sent to the user's inbox -- using the leaked password reset token from the browser. With that crafted link, the malicious user can reset the account owner's password and gain access to their account and the personal data stored within, including account photos, messages, sexual orientation and HIV status and last test date.

According to a Netflix support document, an Apple T2 Security chip is required to stream Netflix in 4K HDR on a Mac. "What that hardware requirement means is that only recent Macs have the ability to play UHD content from Netflix," reports Engadget. From the report: Here's the full list of T2-equipped Macs: 2018 or later MacBook Pro, 2018 or later MacBook Air, 2018 Mac mini, 2019 Mac Pro, iMac Pro and 2020 iMac. If you're not sure whether your Mac has the necessary hardware, you can find out by following the steps Apple details on its website. The Verge suggests the requirement could have something to do with the T2 chip's ability to process HEVC encoded videos. On its webpage for the iMac, Apple says the coprocessor can transcode HEVC video up to twice as fast as its previous generation T1 chip. If Netflix is encoding streams using HEVC, that could explain the requirement. Whatever the case, we've reached out to both Apple and Netflix for more information, and we'll update this article when we hear back from them. There are some other requirements too. In addition to having a T2-equipped Mac, you'll need macOS Big Sur, a Premium Netflix subscription, and the Safari browser -- other browsers will limit you to 720p on a Mac.

Krebs on Security: Companies victimized by ransomware and firms that facilitate negotiations with ransomware extortionists could face steep fines from the U.S. federal government if the crooks who profit from the attack are already under economic sanctions, the Treasury Department warned today. In its advisory, the Treasury's Office of Foreign Assets Control (OFAC) said "companies that facilitate ransomware payments to cyber actors on behalf of victims, including financial institutions, cyber insurance firms, and companies involved in digital forensics and incident response, not only encourage future ransomware payment demands but also may risk violating OFAC regulations." As financial losses from cybercrime activity and ransomware attacks in particular have skyrocketed in recent years, the Treasury Department has imposed economic sanctions on several cybercriminals and cybercrime groups, effectively freezing all property and interests of these persons (subject to U.S. jurisdiction) and making it a crime to transact with them. A number of those sanctioned have been closely tied with ransomware and malware attacks, including the North Korean Lazarus Group; two Iranians thought to be tied to the SamSam ransomware attacks; Evgeniy Bogachev, the developer of Cryptolocker; and Evil Corp, a Russian cybercriminal syndicate that has used malware to extract more than $100 million from victim businesses.

Huawei has failed to adequately tackle security flaws in equipment used in the UK's telecoms networks despite previous complaints, an official report says. From a report: It also flagged that a vulnerability "of national significance" had occurred in 2019 but been fixed before it could be exploited. The assessment was given by an oversight board, chaired by a member of the cyber-spy agency GCHQ. It could influence other nations weighing up use of Huawei's kit. The report said that GCHQ's National Cyber Security Centre (NCSC) had seen no evidence that Huawei had made a significant shift in its approach to the matter. And it added that while some improvements had been made, it had no confidence they were sustainable. As a result, it concluded, the board could only provide "limited assurance that all risks to UK national security" could be mitigated in the long-term. In July, the government announced that due to US sanctions Huawei would eventually be excluded from the new 5G telecoms network by 2027, but the Chinese company can continue to play a role in older mobile phone networks and fixed broadband.

The US has argued that using Huawei's equipment creates a risk of the Chinese state carrying out espionage or sabotage, something the company has always denied. Despite the criticisms, British security officials say they can manage the current risks posed by using Huawei's existing kit, and they do not believe the defects they have found are a result of Chinese state interference. Huawei has responded saying the report highlights its commitment to openness and transparency.

Huawei's Italian President says the company is ready to show that its technology does not pose any security risk to the countries that will include its equipment in the creation of 5G networks. Reuters reports: "We will open our insides, we are available to be vivisected to respond to all of this political pressure...," President Luigi De Vecchis said at the opening ceremony of the group's cyber-security centre in Rome. The United States has lobbied Italy and other European allies to avoid using Huawei equipment in their next generation networks, saying the company could pose a security risk. Huawei rejects those charges. "I am speechless that a country the size of the United States attacks another country through the demolition, via groundless accusations, of a company of that country," he said.

De Vecchis said that, despite all the pressure, Huawei had no intention of leaving the Italian market and was considering adding further products in fields such as energy. "It's extremely unlikely Huawei will leave the market because of the current situation," he said.

A hacker group previously associated with the North Korean regime has been spotted launching spear-phishing attacks to compromise officials part of the United Nations Security Council. From a report: The attacks, disclosed in a UN report last month, have taken place this year and have targeted at least 28 UN officials, including at least 11 individuals representing six countries on the UN Security Council. UN officials said they learned of the attacks after being alerted by an unnamed UN member state (country). The attacks were attributed to a North Korean hacker group known in the cyber-security community by the codename of Kimsuky. According to the UN report, Kimsuky operations took place across March and April this year and consisted of a series of spear-phishing campaigns aimed at the Gmail accounts of UN officials. The emails were designed to look like UN security alerts or requests for interviews from reporters, both designed to convince officials to access phishing pages or run malware files on their systems.

An anonymous reader writes: The Windows XP and Windows Server 2003 source code that was leaked online last week on 4chan has been confirmed to be authentic after a YouTube user compiled the code into working operating systems. Shortly after the leak occurred last week, ZDNet reached out to multiple current and former Microsoft software engineers to confirm the validity of the leaked files. At the time, sources told ZDNet that from a summary review, the code appeared to be incomplete, but from the components they analyzed, the code appeared to be authentic. NTDEV, a US-based IT technician behind the eponymous Twitter and YouTube accounts, was one of the millions of users who downloaded the code last week. But rather than wait for an official statement from Microsoft that is likely to never come, NTDEV decided to compile the code and find out for themselves. According to videos shared online, the amateur IT technician was successful in compiling the Windows XP code over the weekend, and Windows Server 2003 yesterday. "Well, the reports were indeed true. It seems that there are some components missing, such as winlogon.exe and lots of drivers," NTDEV told ZDNet in an interview today, describing his work on XP.

Microsoft is officially revealing it's working on x64 app emulation support for Windows on ARM today. From a report: Currently, Windows on ARM devices like the Surface Pro X can only run native 32- and 64-bit ARM apps, alongside 32-bit x86 apps. The vast majority of desktop apps, including Adobe's Creative Suite, have moved to 64-bit x86 and many have stopped supporting their 32-bit variants. This has left devices like the Surface Pro X unable to access certain apps, but Microsoft's new emulation support will mean any and all Windows apps will now work on Windows on ARM. The new x64 emulation support will start rolling out to Windows Insider testers in November and should arrive in a broader operating system update next year.

An anonymous reader quotes a report from ZDNet: With today's news that French shipping giant CMA CGM has been hit by a ransomware attack, this now means that all of the four biggest maritime shipping companies in the world have been hit by cyber-attacks in the past four years, since 2017. Previous incidents included: 1.) APM-Maersk -- taken down for weeks by the NotPetya ransomware/wiper in 2017. 2.) Mediterranean Shipping Company -- hit in April 2020 by an unnamed malware strain that brought down its data center for days. 3.) COSCO -- brought down for weeks by ransomware in July 2018.

On top of these, we also have CMA CGM, which today took down its worldwide shipping container booking system after its Chinese branches in Shanghai, Shenzhen, and Guangzhou were hit by the Ragnar Locker ransomware. This marks for a unique case study, as there is no other industry sector where the Big Four have suffered major cyber-attacks one after the other like this. But while all these incidents are different, they show a preferential targeting of the maritime shipping industry.

Catalin Cimpanu, writing for ZDNet: For many years, the Microsoft Security Intelligence Report has been the gold standard in terms of providing a yearly overview of all the major events and trends in the cyber-security and threat intelligence landscape. While Microsoft unceremoniously retired the old SIR reports back in 2018, the OS maker appears to have realized its mistake, and has brought it back today, rebranded as the new Microsoft Digital Defense Report. Just like the previous SIR reports, Microsoft has yet again delivered. Taking advantage of its vantage points over vast swaths of the desktop, server, enterprise, and cloud ecosystems, Microsoft has summarized the biggest threats companies deal with today in the face of cybercrime and nation-state attackers. The report is 88 pages long, includes data from July 2019 and June 2020, and some users might not have the time to go through it in its entirety. Below is a summary of the main talking points, Microsoft's main findings, and general threat landscape trends.

[...] But, by far, the most disruptive cybercrime threat of the past year have been ransomware gangs. Microsoft said that ransomware infections had been the most common reason behind the company's incident response (IR) engagements from October 2019 through July 2020. And of all ransomware gangs, it's the groups known as "big game hunters" and "human-operated ransomware" that have given Microsoft the most headaches. These are groups that specifically target select networks belonging to large corporations or government organizations, knowing they stand to receive larger ransom payments. Most of these groups operate either by using malware infrastructure provided by other cybercrime groups or by mass-scanning the internet for newly-disclosed vulnerabilities. In most cases, groups gain access to a system and maintain a foothold until they're ready to launch their attacks. However, Microsoft says that this year, these ransomware gangs have been particularly active and have reduced the time they need to launch attacks, and especially during the COVID-19 pandemic. "Attackers have exploited the COVID-19 crisis to reduce their dwell time within a victim's system â" compromising, exfiltrating data and, in some cases, ransoming quickly â" apparently believing that there would be an increased willingness to pay as a result of the outbreak," Microsoft said today. "In some instances, cybercriminals went from initial entry to ransoming the entire network in under 45 minutes."

Google has recently removed 17 Android applications from the official Play Store because they were infected with the Joker (aka Bread) malware. ZDNet reports: "This spyware is designed to steal SMS messages, contact lists, and device information, along with silently signing up the victim for premium wireless application protocol (WAP) services," Zscaler security researcher Viral Gandhi said this week. The 17 malicious apps were uploaded on the Play Store this month and didn't get a chance to gain a following, having been downloaded more than 120,000 times before being detected.

Following its internal procedures, Google removed the apps from the Play Store, used the Play Protect service to disable the apps on infected devices, but users still need to manually intervene and remove the apps from their devices. But this recent takedown also marks the third such action from Google's security team against a batch of Joker-infected apps over the past few months. [...] The way these infected apps usually manage to sneak their way past Google's defenses and reach the Play Store is through a technique called "droppers," where the victim's device is infected in a multi-stage process. Malware authors begin by cloning the functionality of a legitimate app and uploading it on the Play Store. This app is fully functional, requests access to dangerous permissions, but also doesn't perform any malicious actions when it's first run.

Because the malicious actions are usually delayed by hours or days, Google's security scans don't pick up the malicious code, and Google usually allows the app to be listed on the Play Store. But once on a user's device, the app eventually downloads and "drops" (hence the name droppers, or loaders) other components or apps on the device that contain the Joker malware or other malware strains.

An anonymous reader quotes a report from Business Insider: Last month, Las Vegas' largest public school district announced that a hacker compromised some of its files using ransomware and was holding the files hostage while demanding a ransom payment. Now, a hacker has published files containing students' grades and personal information after school district officials refused to pay the ransom.

Brett Callow, a threat analyst with cybersecurity firm Emsisoft, told Business Insider that he discovered leaked documents published to an online hacking forum that purported to include records from Nevada's Clark County School District, including students' names, social security numbers, addresses, and some financial information. Callow's findings were first reported by The Wall Street Journal on Monday. "Ransomware attacks happen for one reason, and one reason only: they're profitable," Callow told Business Insider. "The only way way to stop them is to make them unprofitable, and that means organizations must stop paying ransoms."

A Texas company that sells software that cities and states use to display results on election night was hit by ransomware last week, the latest of nearly a thousand such attacks over the past year against small towns, big cities and the contractors who run their voting systems. From a report: Many of the attacks are conducted by Russian criminal groups, some with shady ties to President Vladimir V. Putin's intelligence services. But the attack on Tyler Technologies, which continued on Friday night with efforts by outsiders to log into its clients' systems around the country, was particularly rattling less than 40 days before the election. While Tyler does not actually tally votes, it is used by election officials to aggregate and report them in at least 20 places around the country -- making it exactly the kind of soft target that the Department of Homeland Security, the F.B.I. and United States Cyber Command worry could be struck by anyone trying to sow chaos and uncertainty on election night.

Tyler would not describe the attack in detail. It initially appeared to be an ordinary ransomware attack, in which data is made inaccessible unless the victim pays the ransom, usually in harder-to-trace cryptocurrencies. But then some of Tyler's clients -- the company would not say which ones -- saw outsiders trying to gain access to their systems on Friday night, raising fears that the attackers might be out for something more than just a quick profit. That has been the fear haunting federal officials for a year now: that in the days leading up to the election, or in its aftermath, ransomware groups will try to freeze voter registration data, election poll books or the computer systems of the secretaries of the state who certify election results. With only 37 days before the election, federal investigators still do not have a clear picture of whether the ransomware attacks clobbering American networks are purely criminal acts, seeking a quick payday, or Trojan horses for more nefarious Russian interference. But they have not had much success in stopping them. In just the first two weeks of September, another seven American government entities have been hit with ransomware and their data stolen. "The chance of a local government not being hit while attempting to manage the upcoming and already ridiculously messy election would seem to be very slim," said Brett Callow, a threat analyst at Emsisoft, a security firm.

Universal Health Services, one of the largest healthcare providers in the U.S., has been hit by a ransomware attack. "Looks like another case of ransomware at over 400 hospital locations," writes Slashdot reader nickwinlund77. "They've had to go back to pen & paper for handling forms." TechCrunch reports: The attack hit UHS systems early on Sunday morning, according to two people with direct knowledge of the incident, locking computers and phone systems at several UHS facilities across the country, including in California and Florida. One of the people said the computer screens changed with text that referenced the "shadow universe," consistent with the Ryuk ransomware. "Everyone was told to turn off all the computers and not to turn them on again," the person said. "We were told it will be days before the computers are up again."

It's not immediately known what impact the ransomware attack is having on patient care, or how widespread the issue is. UHS published a statement on Monday, saying its IT network "is currently offline, due to an IT security issue." "We implement extensive IT security protocols and are working diligently with our IT security partners to restore IT operations as quickly as possible. In the meantime, our facilities are using their established back-up processes including offline documentation methods. Patient care continues to be delivered safely and effectively," the statement said. "No patient or employee data appears to have been accessed, copied or otherwise compromised," it added.

Around 40 per cent of staff in British and American corporations have access to sensitive data that they don't need to complete their jobs, according to recent research. From a report: In a survey commissioned by IT security firm Forcepoint of just under 900 IT professionals, 40 per cent of commercial sector respondents and 36 per cent working in the public sector said they had privileged access to sensitive data through work. Worryingly, of that number, about a third again (38 per cent public sector and 36 per cent private) said they had access privileges despite not needing them. Overall, out of more than 1,000 respondents, just 14 per cent from the private sector thought their org was fully aware of who had the keys to their employers' digital kingdoms. Carried out by the US Ponemon Institute, a research agency, the survey also found that about 23 per cent of IT pros across the board reckoned that privileged access to data and systems was handed out willy-nilly, or, as Forcepoint put it in a statement, "for no apparent reason." Access management is a critical topic for IT security bods, especially as COVID-19-induced remote working introduces challenges for the monitoring of data access and intra-org flows.

Google's cloud-based service platform for developing and hosting web apps "can be abused to deliver phishing and malware while remaining undetected by leading enterprise security products," reports Bleeping Computer, citing a startling discovery by security researcher Marcel Afrahim: A Google App Engine subdomain does not only represent an app, it represents an app's version, the service name, project ID, and region ID fields. But the most important point to note here is, if any of those fields are incorrect, Google App Engine won't show a 404 Not Found page, but instead show the app's "default" page (a concept referred to as soft routing)...

Essentially, this means there are a lot of permutations of subdomains to get to the attacker's malicious app. As long as every subdomain has a valid "project_ID" field, invalid variations of other fields can be used at the attacker's discretion to generate a long list of subdomains, which all lead to the same app... The fact that a single malicious app is now represented by multiple permutations of its subdomains makes it hard for sysadmins and security professionals to block malicious activity.

But further, to a technologically unsavvy user, all of these subdomains would appear to be a "secure site." After all, the appspot.com domain and all its subdomains come with the seal of "Google Trust Services" in their SSL certificates. Even further, most enterprise security solutions such as Symantec WebPulse web filter automatically allow traffic to trusted category sites. And Google's appspot.com domain, due to its reputation and legitimate corporate use cases, earns an "Office/Business Applications" tag, skipping the scrutiny of web proxies.

"To celebrate Java's 25th anniversary this year and the latest release of Java 15, JetBrains has compiled data from multiple sources to look at what the current state of the language," reports SD Times: The largest concentration of Java developers is in Asia, where 2.5 million developers use it as their primary language. JetBrains believes this may be due to the fact that it is common to hire offshore developers in countries like China and India to build Android apps. "We might have expected the USA to have a high percentage of Java users, but it also makes a lot of sense that they don't. There is a big technology stack to choose from and often a lot of the tech companies are at the forefront of that stack, so it could be that developers there don't need the power or stability of Java and are using languages that allow them to build and test quickly," JetBrains wrote in a post.
The post on JetBrains notes that the six countries with the highest percentage of developers using Java as their primary language are: China, South Korea, India, Germany, Spain, and Brazil: The reasons Java is most likely so popular in the first 6 countries include the free use of Java, governmental support, and open-source... Germany is also very high which could be attributed to Java being the most popular language in Germany for software engineers as it is used to build highly scalable applications for a multitude of industries. Most enterprise services rely on Java to power the applications that enable the day-to-day running of businesses, such as payroll, inventory management, reporting, and so on. Germany also has a big financial sector that uses Java heavily for their homegrown tech, such as trading bots, retail banking systems, and other applications that the finance industry requires in order to remain competitive...

According to the State of the Developer Ecosystem Survey 2020, more than a third of professional developers use Java as a primary language and Java remains the second primary language among professional developers after JavaScript. Expert analysis: It is not surprising to see JavaScript and Java taking the leading positions as they are kind of paired together; developers who work with Java often write their frontend and any quick scripts in JavaScript. Python is probably third place due to the spread of machine learning. In general, we expect the web to be a big part of the developer ecosystem and so JavaScript, HTML and CSS, and PHP will always have solid standing. SQL is also always going to be around as there isn't much that doesn't require databases in some capacity. C++ is also kind of a solid language in that it is used for a lot of embedded applications, so it won't be disappearing off the charts any time soon. C# though seems to be losing ground, and I guess if Java is high then C# will be low, as they are both very similar in terms of capabilities.

As to why I think Java is so high in the sphere of professional development — it's similar to what was mentioned about Germany. Most enterprise business services rely on Java to make them tick along. It's not just the IT sector either — almost every company, be it in distribution, manufacturing, or banking, has IT services as part of their infrastructure, and these services, such as payroll or inventory management, are generally built with Java in the backend. So Java is used a lot by professional developers who work for these companies.