Wi-Fi 6

 

While the IEEE 802.11 standard defines the Wi-Fi standard, the Wi-Fi Alliance is an industry group that also helps to define these technologies. This group is responsible for the ‘Wi-Fi CERTIFIED’ program which ensures interoperability between devices regardless of their vendor. The internet of things (IoT) is becoming more prevalent in our everyday lives and within industrial settings, and this is driving the demand for more secure, efficient, and reliable connectivity methods. As customers ask for higher capacity and lower latency Wi-Fi, the community is pushing to adopt new capabilities and features to support these requests.

The next generation is called Wi-Fi 6, based on the 802.11ax standard, and it provides a variety of features such as ‘orthogonal frequency division multiple access’ (OFDMA) which improves performance in dense environments so devices can divide the spectrum allowing for a more consistent and deterministic network experience. For example, smaller packets can still be transmitted while larger packets for video streaming are unaffected.

‘Target wake time’ (TWT) is another feature of Wi-Fi 6 that allows connected devices to determine how frequently they should awake and transceive data. Basically, access points can now increase a device’s sleep time thus extending battery life and lowering consumption. This is imperative for smart and IoT devices which are required 24 hours a day, but don’t need to always be on.

Used in conjunction with the Wi-Fi Alliance’s ‘HaLow’, IoT devices remain power-efficient. HaLow provides long-distance, speed, low-power, penetration, and security features that other technologies do not. This technology supports higher throughput at ranges up to a kilometre while consuming a low amount of power and maintaining performance.

The alliance has also expanded their ‘CERTIFIED’ program to help optimise networks that are experiencing a rapid growth in the number and type of devices connecting to personal and corporate networks. For example, 1 certification is provided for those devices that improve mobility when roaming between networks. Other optimisations focus on QoS management or helping providers and network managers manage complex networks with more secure, efficient, and smart Wi-Fi networks.

In the most demanding wireless network environments, Wi-Fi 6 provides users the coverage, capacity, efficiency, and performance that is required as more devices are connected to our networks. The features of this next generation technology will only continue to grow in demand as out homes and offices become more connected through smart devices.

The LAPSUS$ Group

 

Microsoft and Okta have this week disclosed breaches involving the data extortion group ‘LAPSUS$’. This group first surfaced in December 2021 when attempting to extort Brazil’s Ministry of Health, but has recently made headlines again after claiming they were behind the NVIDIA, Samsung, and Vodafone hacks. The group announced it was released Microsoft source code, but Microsoft announced it was able to interrupt the group’s download before it could finish and thus limited the broader impact. Apparently, no customer data was involved, and the attack was launched through a single account compromise which granted the group limited access. Microsoft states they do not rely on secret code, and a release or viewing of source code does not lead to elevated organisation risk.

LAPSUS$ mainly gains illicit access to targets through social engineering by tricking or bribing employees or partners of the organisations they’re targeting, including customer support employees. Microsoft refers to the group as “DEV-0537”, and they found the group is bribing willing accomplices to provide their credentials and authentication information or allow the installation of remote management software so the hackers can take control of authenticated systems.

The group has its own Telegram channel with over 45,000 subscribers and the hackers actively recruit insiders at large telcos, software companies, hosting firms, and call centres in this channel and through other social media channels such as Reddit. Some employees are being offered up to $20,000 a week. LAPSUS$ claims it is not state-sponsored, but the individuals are clearly highly experienced and have a wide range of technical knowledge.

The attackers have targeted personal accounts, which are typically used for second-factor authentication or password recovery, to gain access to corporate systems or gain additional credentials. In other scenarios, LAPSUS$ has called an organisation’s help desk and convinced personnel to reset a privileged account’s credentials. As many organisations outsource their help desk support, the group is actively exploiting these relationships to help gain access to corporate systems.

The group has also used SIM swapping to access privileged accounts at target companies. The attackers bribe or trick mobile company employees into transferring a phone number to their device so they can then intercept one-time passwords or prompt a password reset via SMS. LAPSUS$ has also searched public repositories for exposed passwords, purchased credentials and session tokens from online forums, and made use of the “Redline” malware to steal passwords.

It appears a member of the group was also involved in the breach on Electronic Arts (EA) last year where 780GB of source code was supposedly held at ransom. This attack was achieved by buying authentication cookies for an EA Slack channel from a marketplace on the dark web.

‘WhiteDoxbin’ is the supposed leader of the group who started out trading zero-day vulnerabilities. Last year they purchased Doxbin, a website that allows personal information of individuals to be posted. Apparently, the new owner was not able to keep the site functioning properly, and has been targeted by the site’s users as a result. Since then, they have sold the forum back to its previous owner for a loss, but not before leaking the whole Doxbin dataset via its Telegram channel. The site’s users again responded by providing a thorough dox of ‘WhiteDoxbin’ – including videos outside a house in the UK and the personal information of family members.

Recent developments include 7 people in the UK being arrested in connection to the hacking group, according to the City of London Police.