AMD Radeon Graphics Cards Open VMware Workstations to Attack

Threatpost | September 17, 2019

A remote code-execution bug exists in some configurations of the AMD Radeon graphics card that could allow an attacker to take control of a targeted system. The hack entails luring users of vulnerable systems to visit a specially crafted website that can deliver “a malformed pixel shader” to either a Radeon RX 550 or a Radeon 550 series graphics card. The prerequisites for the attack limit the scope of those impacted. According to Cisco Talos, which found the bug in May, the vulnerability only exists on systems running VMware Workstation 15 with the 64-bit version of Windows 10 running as the as guest VM. This vulnerability can be triggered by supplying a malformed pixel shader (inside VMware guest OS) to the AMD ATIDXX64.DLL driver. Such an attack can be triggered from a VMware guest usermode to cause a memory corruption on vmware-vmx.exe process on host, or theoretically through WEBGL (remote website),” according to the Talos Vulnerability Bulletin, published Monday.

Spotlight

6G requires setting achievable goals and continuous communication with the market and consumers.  Efforts of all participants in the new 6G ecosystem are required, such as expanding of 6G usage scenarios, selecting candidate spectrums, vitalizing open interfaces, e.g., Open RAN, and simple architecture options, etc.

Spotlight

6G requires setting achievable goals and continuous communication with the market and consumers.  Efforts of all participants in the new 6G ecosystem are required, such as expanding of 6G usage scenarios, selecting candidate spectrums, vitalizing open interfaces, e.g., Open RAN, and simple architecture options, etc.

Related News

VPN

Internet Engineering Task Force standardises quantum-safe VPN protocol created by Post-Quantum

Businesswire | July 18, 2023

The world’s efforts to secure digital communications from the threat posed by quantum computers took a significant leap forward today as a new standard for quantum-safe Virtual Private Networks (VPN) was ratified by the Internet Engineering Task Force (IETF). The new protocol has already been used by Banque de France and Deutsche Bundesbank to secure payments messages, paving the way for full adoption by the Bank for International Settlements to secure communications between the world’s central banks. ‘Harvest Now Decrypt Later’ (HNDL) attacks currently represent the greatest quantum cybersecurity threat. These attacks see hostile actors steal encrypted data now which can be decrypted once a sufficiently mature quantum computer comes online. The new US Quantum Computing Cybersecurity Preparedness Act states that the HNDL risk presents the highest threat to humankind and stipulates that quantum migration must start now. Deploying a VPN based on new post quantum cryptography is the easiest way to protect data-in-transit from such attacks. The new IETF standard specifies how VPNs can exchange communications securely in the quantum age. The novel approach prioritises interoperability by making it possible for multiple post-quantum and classical encryption algorithms to be incorporated into VPNs. Combining both old and new encryption is essential to ensure no disruption to the functioning of existing IT systems, and to protect data from attack by both classical and quantum computers. This is a particularly important milestone for internet connectivity and security as we are transitioning from an era where the world relied upon just one or two algorithms (RSA and Elliptic Curve), to a situation where different nation states are deploying a wide variety of different post-quantum algorithms. This new IETF standard is the glue that allows parties using different public key encryption algorithms to talk with one another. The new IETF standard was proposed and designed by Post-Quantum, a British cyber security company that’s built a portfolio of market-ready quantum-safe cyber security products. Post-Quantum’s own Hybrid PQ VPN uses the new IETF standard and is already in use by NATO to secure its communications from quantum attack, supporting interoperable communications between NATO members. CJ Tjhai, CTO, Post-Quantum and original author of the new IETF standard said: “I’d like to thank all the technologists that collaborated with us on this IETF standard. Much of the focus has been on NIST’s new post quantum encryption algorithms themselves, but this is insufficient unless you have a protocol that defines how the connectivity is done. The easiest way to prevent Harvest Now Decrypt Later attacks is to deploy a PQ VPN based on the new IETF standard. NIST’s new algorithms are only useful if we have agreed standards for their use and mature products that can accommodate them.” Andersen Cheng, Executive Chairman, Post-Quantum added: “CJ and his collaborators have completed important work that makes it possible for tech companies to build quantum-safe VPNs that communicate to one another. We are entering a period where different countries are now recommending different encryption algorithms, so engineering our communications infrastructure to be interoperable and backward compatible is absolutely crucial. That’s the value our own VPN is bringing to organisations like NATO, a diverse member organisation with a variety of post-quantum algorithms in use. “In the commercial sector, we are pleased that Banque de France and Deutsche Bundesbank have also recently completed their project in transmitting payment messages using our protocol, which will pave the way for the Bank for International Settlements to build a complete chain of trust for central bank applications to counter any HNDL risks they already face today.” José María Lucía Moreno, Lead Partner, EY Wavespace and a Post-Quantum partner added: “Our agreement with Post-Quantum is an important step in helping EY and its clients to become quantum-safe. We’re increasingly consulting with our clients to identify where they use traditional encryption that will need to be upgraded, and to help them prepare for the quantum era. Post-Quantum’s approach is particularly interesting because they have modular software-based products like the VPN, which can be implemented together, or as standalones within existing environments, to offer protection today.” The IETF is the non-profit organisation with responsibility for developing the standards that define how the internet is built and used. Now that the IETF has ratified this work, VPN providers will adapt their protocols to match it, making this a defining standard for the future of cybersecurity as the world transitions from classical to new post-quantum encryption. Ratification represents the culmination of work dating back to 2017 when Post-Quantum took the lead in creating the original proposal for this standard. About Post-Quantum Post-Quantum is upgrading the world to next-generation encryption. Our quantum-safe platform includes modular software for Identity, Transmission and Encryption that protect organisations across their entire digital footprint. Products are interoperable, backward compatible and crypto-agile - ensuring a smooth transition to the next generation of encryption. Post-Quantum works with organisations in defence, critical national infrastructure and financial services, including a multi-year relationship with NATO to ensure its communications are secure against quantum attack.

Read More

Server Virtualization, Security

Syncro Expands Its Offering with a New Team Plan and Features Targeting Growing MSPs

businesswire | August 11, 2023

Syncro,an all-in-one professional services automation (PSA) and remote monitoring and management (RMM) platform for managed service providers (MSPs), today announces the addition of the newTeam plan for MSPs. Syncro is providing this new premium tier plan to equip growing MSPs with more advanced features and onboarding support that will help them better manage their team’s tasklist and business growth. The new Team plan is designed for MSPs with multiple technicians and empowers them to organize and automate their workflows how they choose. The plan includes PowerBI reports with in-depth data aggregation and insights, more automation, stronger remote access capabilities, and ticket workflow enhancements offering more management oversight. The Team plan also provides more support convenience, giving MSPs the ability to schedule one on one troubleshooting sessions with Syncro technicians. The addition of the Team plan allows MSPs to take advantage of features that will help them to solve the challenges that come with managing a growing business efficiently with many technicians and even more clients. This powerful plan offers the following benefits and features: Enhanced Splashtop: Includes multi-monitor support and multiple techs per session. Azure AD sync: Seamless integration with Azure AD to enable contact syncing and Microsoft 365 billing automation. Real-time ticket automations & assignments: Streamlines your service desk operations. PowerBI integration: Facilitates advanced analytics and business intelligence. Scheduled database exports: Automatically export your Syncro data to a database of your choosing. Personalized support and onboarding experience: Enjoy scheduled callbacks for technical issues and implementation experts to help you onboard. The Team plan is available for $189/user/month. Syncro's current base plan (now renamed as Core) at $139/user/month is still available with all existing features, and at the same price. Both the Core and Team plans offer a no-contract monthly per user price, with unlimited endpoints and access to the entire Syncro platform including PSA/RMM and remote access functionality. “Syncro’s first priority has been and will always be helping MSPs expand their business – from MSPs who are just starting out to MSPs who are well-established and experiencing rapid growth. The launch of the Team plan and the newest features is a direct result of listening to the needs of our growing partners and just another way we are supporting MSPs and enabling them to be more profitable,” said Emily Glass, CEO of Syncro. About Syncro Syncro's all-in-one PSA, RMM, and remote access software helps managed service providers (MSPs) run more efficient and profitable businesses. Pricing is refreshingly simple, with no contracts and flat per user pricing. A technology company with a human heart, Syncro is committed to diversity, inclusion, belonging and fair practices that benefit everyone—from customers and employees to the industry at large.

Read More

Virtual Desktop Strategies, Virtual Server Management

VMware Advances Autonomous Workspaces with AI-Powered Integrations

Business Wire | August 28, 2023

VMware Explore 2023 — Data and intelligence play a key role in enabling automation and implementing a successful hybrid work strategy, but a holistic approach is required to maximize its advantages. Today, VMware announces modern AI integrations to the Anywhere Workspace platform, part of the VMware Cross-Cloud services portfolio, that automatically optimize employee experience, drive new vulnerability management use cases, and simplify application lifecycle management. VMware Anywhere Workspace is the only hybrid work platform that integrates digital employee experience (DEX), virtual desktop infrastructure and apps (VDI and DaaS), unified endpoint management (UEM) and security to enable a seamless and secure workspace on any device or location. “Last year, we announced our Autonomous Workspace vision as a path forward for organizations to navigate the challenges brought on by hybrid work,” said Shankar Iyer, senior vice president and general manager, End-User Computing, VMware. “We are thrilled to unveil new advancements for our customers that expand data sources and insights, integrate with technology partners for improved security, and unify app delivery strategy across all virtual desktops and apps. These innovations continue to progress our vision of providing the next evolution of digital workspaces.” Integrated AI-Driven Platform Scales Experience Management VMware continues to leverage data, intelligence, and automation to improve the employee and IT experience by introducing new Insights and Playbooks based on greatly expanded data and machine learning algorithms that enhance DEX remediation capabilities. These updates broaden access to data, help strengthen VMware Insights, and allow for remediation of more issues. VMware will now enable delivery of new app performance scores, in addition to existing mobile device, desktop, and virtual environment experience scores. If a SaaS app service goes down, IT is proactively alerted and employees are automatically notified. This allows IT to quickly resolve the outage without dealing with inbound support tickets and employees don't waste time trying to access unavailable services. But simply providing IT with more data is not enough to empower them to work smarter. VMware’s AI-driven Insights feature now provides anomaly detection that informs IT of potential experience issues for frontline devices and VDI environments, in addition to mobile and desktop environments. Today’s announcement of new Playbooks enables IT to create step-by-step remediation workflows to resolve incidents more efficiently and use success rate analytics to automate the resolution process and streamline execution over time. “Workspace ONE Intelligence has been a game changer for us when it comes to automating life cycle management inside UEM. We have been utilizing it for automatically tagging devices and assigning them into smart groups. We have also used several dashboard templates for monitoring our security stance and helping remediate high-risk security threats,” said George March, manager of digital workspace and development, Information Technology, USA Health. “Next on our roadmap is implementing the ITSM connector, and with the addition of remediation playbooks, we are so excited about the way it will streamline our help desk support teams workflows.” Unique Partner Integration Powers New Security and Manageability Use Cases Ensuring end-to-end manageability and security for today’s distributed workforce is critical and requires a holistic approach to vulnerability assessment, prioritization, remediation, out-of-band support, and reporting. Collaboration with a best-of-breed partner ecosystem that offers speed, breadth, and depth in vulnerability management is necessary to protect against sophisticated attack vectors. VMware is committed to innovating together with our technology partners to provide customers with more secure and seamless hybrid experiences. Today, VMware continues this mission by announcing an expanded partnership with Intel through a one-of-a-kind, cloud-native integration of Workspace ONE with Intel vPro®. This chip-to-cloud integration makes it easier to secure and remotely manage work devices entirely from the cloud, with no additional on-premises infrastructure and management software needed. Through line of sight and out-of-band management of vPro powered devices, IT teams can have below-the-OS vulnerability insights, and visibility to reduce the impact of potential exploits quickly and efficiently. Using Workspace ONE, customers can have centralized visibility into Intel vPro-powered PCs and accelerate patch remediation cycles for devices located outside of office perimeters, even if the devices are sleeping or powered off. This improves security and compliance by accomplishing higher patch saturation with fewer remediation steps and reduces potential disruption to employee productivity. Modern App Management Simplifies Virtual Environments Managing and delivering apps across VDI, DaaS, and published app environments has become increasingly complex and inefficient due to silos of legacy tools used. VMware recently introduced Apps on Demand, powered by VMware App Volumes, to unify app management and intelligently deploy apps to published app hosts or non-persistent desktop environments, all based on real-time app usage. Today, VMware announces additional expansion of App Volumes support to deliver apps on demand to persistent virtual desktops. Now in beta availability, customers with persistent VMware Horizon environments will be able to use App Volumes to capture their apps once and deliver to many persistent virtual desktops. This automates the app delivery process with up to 99% compatibility and reduces management time and costs for any desktop or published app environment. VMware App Volumes is the only solution to help organizations deliver and manage apps across VMware Horizon, Citrix, Microsoft, and Amazon virtual desktop and app deployments as part of VMware’s Apps Everywhere vision. Boeing: A ‘Hybrid Workforce Innovator’ The Boeing Company (Boeing) has used VMware Workspace ONE across the United States and in more than 65 countries to support its global workforce of 140,000 employees who develop, manufacture and service commercial airplanes, defense products and space systems for its customers. At VMware Explore 2023 Las Vegas, they were named ‘Hybrid Workforce Innovator’ as part of the 2023 VMware Customer Achievement Awards for the Americas for enabling its workforce to work from anywhere in the world, improving the user experience while reinforcing and advancing security for devices and applications. “VMware Anywhere Workspace helps us manage and protect end points, provide a common platform to access apps and tools, as well as helping facilitate a digital experience for our employees,” said Kristina Ross, Boeing Workplace Solutions director for Research & Technology. “Workspace ONE helped streamline our transition from traditional PC lifecycle management to Windows 10 modern management which was enabled by our shift to a SaaS-based solution for the company. Today, we have a unified view to oversee all endpoint requirements, and the adoption of SaaS enhanced our scalability and ability to shift focus from infrastructure to business facing solutions.” About VMware VMware is a leading provider of multi-cloud services for all apps, enabling digital innovation with enterprise control. As a trusted foundation to accelerate innovation, VMware software gives businesses the flexibility and choice they need to build the future. Headquartered in Palo Alto, California, VMware is committed to building a better future through the company’s 2030 Agenda.

Read More