RSA: Theme Endpoint Security

I had the chance to walk around a bit on the second day of RSA. One thing that really stood out was this year’s buzzterm: endpoint security.

So what does it actually mean? Well, this document defines it as applying a security solution to “an individual computer system or device that acts as a network client and serves as a workstation or personal computing device. Endpoints are often mobile and intermittently connected”. It’s mostly used to refer to a PC desktop, laptop, PDA and, most commonly, a smartphone.

For anybody who’s labouring under the happy delusion that we’ve reached the pinnacle of (security-solution) hardware engineering and creativity, the truth is we’ve only just started to develop devices to further increase our mobility. For example, if you’re in the medical field, “endpoint” could refer to a dedicated data-recording device.

Where does this all lead? To use an analogy that many of us will understand, while our schooldays may well be behind us, we should never stop striving to learn more. To learn about what? Yes, about the great advantages that increased mobility offers us, but also about the sheer variety of risks and threats that currently exist, and which will continue to evolve in the future. In other words, if you are one of the millions of people who take your work on the road (or home) with you, plan to hit the books! As we never tire of saying – wherever there are new opportunities, the bad guys are always on the lookout for new methods of attack.

Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.

Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.