As a new generation of cyber threats emerges, a new breed of cyber security defenders is emerging. They don’t wait for enemies to strike, but go looking for them, writes ARTHUR GOLDSTUCK.
Meet Alex and Andy. They are young, clean-cut and casually dressed men who may not draw a second glance if you bump into them in public. Behind closed doors, however, they are the information age’s equivalent of fearsome warriors. They are called threat hunters.
No, they are not super-heroes. Although they are heroes to some organisations.
Five years ago, the job description didn’t even exist. Back then, security experts waited for the hackers to strike, then rushed around repairing the damage, fixing the holes and, just maybe, chasing down the bad guys.
But that’s not good enough today. As hackers become more sophisticated in both their methods and their tools, and the stakes get higher in lost data and massive financial fraud, the security industry also has to evolve.
Alex and Andy represent the cutting edge of this evolution. In an age of heavy reliance on algorithms and artificial intelligence to predict and block standard threats, it turns out that human intuition is far more powerful in spotting unusual and new kinds of attack.
They work in Johannesburg for a global cyber security consultancy called MWR InfoSecurity, which develops tailored security solutiosn for clients that range from governments to corporations.
Their boss, Jacques Louw, MWR director and head of Cyber Defence, describes threat hunting as a technique that “focuses on the human elements in attack detection”. In this environment, he says, “one cannot have automated threat hunting”.
He uses the evolution of physical home security as an analogy for the growing need for a new kind of approach.
“We’ve seen in the last decade or so that, ultimately, you cannot prevent attackers from climbing over your walls no matter how high you build them; they always seem to find a higher ladder. So the focus has really been towards detection and response for when they do manage to get over. In this regard, detection is critical – if you don’t see the intruder, then the armed response never arrives, whereas if you have too many false alarms, the armed response will stop showing up.”
Add the fact that organised crime syndicates are now targeting major corporations, and state sponsored teams are going after national governments, the challenge becomes even more complex. Enter a new kind of detection.
“Detecting attacks is not a new idea,” says Louw. “In fact it’s been around for many years, comprising automated systems like anti-virus and intrusion detection or prevention systems. Think of them as anti-virus for a network traffic.
“Such systems were originally built to deal with viruses or malicious software or malware that was self-propagating – which means it spreads on its own in an automated way. After the malware is created, it acts automatically, executing the tasks it was initially programmed to do.
“Traditional anti-virus works by analysing a piece of malware, creating a signature for it and adding it to a database – similar to that of a book of criminal records. The anti-virus then checks each new program on a system against these records, and alerts you when it finds one with features similar to that of one of the records.
“Unfortunately, the first problem here is that you need to discover a piece of malware before you can create a signature for it, so it has to succeed in attacking someone first before a signature can exist. Moreover, it is quite easy for a programmer to change what the malware looks like – while still having the malware do the same thing. So changing features, but not behaviour.”
A key reason traditional security is no longer enough is that the threat has evolved from the equivalent of a property invasion to something far more elaborate.
Louw compares a modern corporate network to a large city, with multiple roads in and out and many thousands of everyday people performing many different activities across the city.
“In this analogy, a signature-based system is similar to a simplistic robot that walks around the city, trying to match faces of people he sees to a photo in the mugshot book. In contrast, threat hunting is like a human policeman that can actually spot bad behaviour, not because each bad activity has been strictly defined and given to him on a long list, but rather because he can use his experience, knowledge of the law and judgement to make a call on some behaviour that has never been seen before.”
An example is a form of malware that operates not like a virus spreading through the system, but like a hole in the system. Appropriately called RATS, for Remote Access Trojans, these are “exploits” that can easily be altered slightly to bypass anti-virus every time they are used.
“The attacker only needs to find a single entry-point to compromise an organisation, so the defender must defend all systems perfectly all the time to be secure,” says Louw. This concept is known in security as “the defender’s dilemma”
“In threat hunting, one of the ways we are responding to this dilemma is by using a judo-like technique called the anomaly analysis, where we can turn the attackers greatest advantage into a disadvantage. Instead of looking for something bad on a large network of systems, we look for something that is different and investigate it accordingly.
“If the attacker attacks a system on the network, that system will appear different to all of the other systems in some way – allowing the attack to be detected even if we don’t have a signature for exactly what the attacker is doing. This may sound simple, but you can easily recognise that certain differences are more interesting than others and that is where human skill comes into play.
“You can have automated systems gathering data from all systems, collecting network traffic and pulling in logs from systems. Ultimately, however, you need a human to drive the analysis.”
Acer gaming beast escapes
Acer this week unveiled two notebooks that take portable gaming to new extremes.
Acer unveiled two new Predator Helios gaming notebooks this week at the next@acer global press conference in New York. They include the powerful Predator Helios 500, featuring up to 8th Gen Intel Core i9+ processors, and the Predator Helios 300 Special Edition that includes upgraded specs from its predecessor and a distinctive white chassis. Both feature VR-Ready performance, advanced thermal technologies, and blazing-fast connectivity.
“We’ve expanded our Predator Helios gaming notebook line in response to popular demand from gamers seeking extreme performance on the go,” said Jerry Kao, President of IT Products Business, Acer. “The Predator Helios 500 and Helios 300 gaming notebooks feature Acer’s proprietary thermal technologies and powerful components that, coupled with our award-winning software, deliver unparalleled gaming experiences.”
“The 8th Gen Intel Core i9+ processor for gaming and creation laptops is the highest performance Intel has ever delivered for this class of devices; purpose built for enthusiasts who demand premium gaming experiences whether at home or on the go,” said Steve Long, Vice President and General Manager, Client Computing Group Sales and Marketing, Intel. “Intel and Acer’s long relationship has produced amazing products over the years, and the new Acer Predator Helios gaming notebooks are powerful examples of what’s possible with this unprecedented level of performance.”
Predator Helios 500 is a gaming beast featuring overclocking, 4K 144 Hz panels
Designed for extreme gamers, the Predator Helios 500 is a gaming beast. It features up to overclockable 8th Gen Intel Core i9+ processors and overclockable GeForce GTX 1070 graphics. Intel Optane memory increases responsiveness and load times, while ultra-fast NVMePCIe SSDs, Killer DoubleShot Pro networking, and up to 64GB of memory keep the action going, making the Helios 500 the ideal gaming notebook for graphic-intensive AAA titles and live streaming.
Top-notch visuals are delivered on bright, vibrant 4K UHD or FHD IPS 17.3-inch displays with 144Hz refresh rates for blur- and tear-free gameplay. NVIDIA G-SYNC technology is supported on both the built-in display and external monitors, allowing for buttery-smooth imagery without tearing or stuttering. For those looking for maximum gaming immersion, dual Thunderbolt 3 ports, and display and HDMI 2.0 ports support up to three external monitors. Two speakers, a subwoofer, and Acer TrueHarmony and Waves MAXXAudio technology deliver incredible sound and hyper-realistic 3D audio using Waves Nx.
The Helios 500 stays cool with two of Acer’s proprietary AeroBlade 3D metal fans, and five heat pipes that distribute cool air to the machine’s key components while simultaneously releasing hot air. Fan speed can be controlled and customized through the PredatorSense app.
A backlit RGB keyboard offers four lighting zones with support for up to 16.8 million colors. Anti-ghosting technology provides the ultimate control for executing complex commands and combos, which can be set up via five dedicated programmable keys.
Acer’s PredatorSense app can be used to control and monitor the notebook’s vitals from one central interface, including overclocking, lighting, hotkeys, temperature, and fan control.
Predator Helios 300 Special Edition brings a sophisticated design twist to gaming notebooks
Acer’s budget-friendly Helios 300 gaming line sees the addition of a Special Edition model featuring an all-white aluminum chassis accented with gold trim, an unusually chic design for gaming notebooks.
The Helios 300 Special Edition (PH315-51) allows for ultra-smooth gameplay via its 15.6-inch FHD IPS display with an upgraded 144Hz refresh rate. The rapid refresh rate shortens frame rendering time and lowers input lag to give gamers an excellent in-game experience. It’s powered by up to an 8th Gen Intel Core i7+ processor, overclockable GeForce GTX 1060 graphics, up to a 512 GB PCIe Gen 3 NVMe solid state drive, and up to a 2 TB hard disk drive.
The Helios 300 Special Edition also comes equipped with up to 16 GB of DDR4 memory, and is upgradable to 32GB. Intel Optane memory speeds up load times of games and applications, access to information and improves overall system responsiveness. In addition, Gigabit Ethernet provides fast wired connections, while Gigabit Wi-Fi is provided by the latest Intel Wireless-AC 9560 that delivers up to 1.73Gbps throughput when using 160 MHz channels (2×2 802.11ac, dual-band 2.4GHz and 5GHz).
The Helios 300 Special Edition also includes two of Acer’s ultrathin (0.1 mm) all-metal AeroBlade 3D fans designed with advanced aerodynamics and superior airflow to keep the system cool. They can be controlled with Acer’s PredatorSense app, which offers three usage modes:
1. Coolboost mode:
For heavy loading games, rendering, streaming, and extended video consumption
2. Normal mode:
For productivity tools like Microsoft Office
3. Silent mode:
For web browsing and online chatting
Price and Availability
Predator Helios 500 will be available in South Africa in June starting at R34 999.00
Helios 300 Special Edition will be available in South Africa in August 2018. Exact Price will be communicated closer to the time.
LG G7 arrives in SA
LG this week introduced South Africa to its latest premium smartphone, the LG G7 ThinQ, focused on bringing useful and convenient AI features to the smartphone experience.
Powered by the latest Qualcomm Snapdragon 845 Mobile Platform, the LG G7 ThinQ offers 4GB of RAM and 64GB of internal storage to run demanding tasks and apps with. It is equipped with a 6.1-inch Super Bright Display, but the LG G7 ThinQ remains compact enough to use with one hand.
Sporting a new design aesthetic for the G series, the polished metal rim gives the LG G7 ThinQ a sleeker, more refined look, complemented by Gorilla Glass 5 on both the front and the back for enhanced durability. Rated IP68 for dust and water resistance, the LG G7 ThinQ is also awarded MIL-STD 810 c certification, having been subjected to a range of extreme temperature and environment tests designed by the United States military.
The LG G7 ThinQ has an 8MP camera up front, rendering clear and natural selfies, with two 16MP cameras at the back that deliver higher resolution photos with more detail, as well as a Super Wide Angle configuration.
As with other leading brands, LG has evolved its signature camera by including AI functionality. The AI CAM offers 19 shooting modes for intelligence-optimised shots. Users can also improve their photos by choosing from an additional three effect options should the AI CAM recommendation not suit their taste.
The new Super Bright Camera captures images that are up to four times brighter than typical photos shot in dim light. Through the combination of pixel binning and software processing, the AI algorithm adjusts the camera settings automatically when shooting in low light.
Live Photo Mode records one second before and after the shutter is pressed for snippets of unexpected moments or expressions that would normally be missed. Stickers uses face recognition to generate fun 2D and 3D overlays, such as sunglasses and headbands, that can be viewed directly on the display.
New to the G series is Portrait Mode, which generates professional-looking shots with out-of-focus backgrounds. This effect can be generated using both front and rear standard lenses as well as the rear Super Wide Angle lens.
LG G7 ThinQ offers further AI functionality with the inclusion of Google Lens features. Google Lens is a new way to search using the AI and computer vision. Google Assistant and Google Photos allow users to access more information on objects such as landmarks, plants, animals, and books. It can identify text or visit websites, add business cards to contacts, events to the calendar or look up an item on a restaurant menu.
A button just below the volume keys launches the AI functionality. A single tap of this button launches the Google Assistant, while two quick taps launches Google Lens. Users can also hold down the button to start talking to the Google Assistant without the repetition of the OK Google command.
With Super Far Field Voice Recognition (SFFVR) and the highly-sensitive G7ThinQ microphone, the Google Assistant can recognise voice commands from up to five meters away. SFFVR is able to separate commands from background noise, making the LG G7 ThinQ an alternative to a home AI speaker, even when the TV is on. Commands for the Google Assistant have been increased in the LG G7 ThinQ so users can get more done with their voice alone.
“The LG G7 ThinQ is strongly focused on the fundamentals and its launch marks a new chapter for our company,” said Deon Prinsloo, General Manager for Mobile Communication, LG Electronics S.A Pty Ltd. “Through the combination of personalised and useful AI functionalities with meaningful smartphone features, this is LG’s most convenient and in the moment smartphone yet.”
- Mobile Platform: Qualcomm Snapdragon 845 Mobile Platform
- Display: 6.1-inch QHD+ 19.5:9 FullVision Super Bright Display (3120 x 1440 / 564ppi)
- LG G7 ThinQ: 4GB LPDDR4x RAM / 64GB UFS 2.1 ROM / MicroSD (up to 2TB)
- Rear Dual: 16MP Super Wide Angle (F1.9 / 107°) / 16MP Standard Angle (F1.6 / 71°)
- Front: 8MP Wide Angle (F1.9 / 80°)
- Battery: 3000mAh
- OS: Android 8.0 Oreo
- Size: 153.2 x 71.9 x 7.9mm
- Weight: 162g
- Connectivity: Wi-Fi 802.11 a, b, g, n, ac / Bluetooth 5.0 BLE / NFC / USB Type-C 2.0 (3.1 compatible)
- Colours: New Aurora Black
- Others: Super Bright Display / New Second Screen / AI CAM / Super Bright Camera / Super Far Field Voice Recognition / Boombox Speaker / Google Lens / AI Haptic / Hi-Fi Quad DAC / DTS:X 3D Surround Sound / IP68 Water and Dust Resistance / HDR10 / Google Assistant Key / Face Recognition / Fingerprint Sensor / Qualcomm Quick Charge 3.0 Technology / Wireless Charging / MIL-STD 810G Compliant / FM Radio