Cyber security warning: BazarBackdoor

Beware of the recent BazarBackdoor exploit. The malware works by sending an email which contains a link to a PDF file. The email may reference a customer complaint.

According to Sophos the link may appear like this and be to a URL referencing Adobe:

The link actually leads to the Win 10 application installer (used by the Microsoft store) and the recipient will be prompted to install an ‘Adobe PDF Component’.

The app installer file comes with its own doctored digital certificate.

Amongst other things BazarBackdoor runs PowerShell to get the IP address of your network.

Degausser oersted strength

The Tip of the Night for April 28, 2021 discussed Degaussing, which erases magnetic storage media by altering magnetic fields. Different drives and tapes will have varying 'coercivity'. Coercivity is the intensity of the magnetic field required to eliminate the magnetization of the storage device. Different kinds of magnetic media are classified into one of three types based on their oersted count - a unit of magnetic field strength.

Type I devices will have 350 oersteds or less. Type II magnetic media have between 350 and 750 oersteds. Type III storage devices will possess more than 750 Oe.

Not all Degaussers can erase every type of magnetic media. For example, the HP LTO-8 30 TB data tape cartridge, available here, has a magnetic coercivity of 2300 Oe.

A guide to Degaussers published by the National Security Agency in June 2019, NSA/CSS Evaluated Products List for

Magnetic Degaussers, rates Degaussers based on their Oe rating. As you can see, older model Degaussers will not be able to successfully erase this HP tape.

The oersted rating for a Degausser may differ based on whether the media being erased is a drive or a tape.

Finding near duplicates in Viewpoint

Elite Discovery's Viewpoint document review platform can assist with near duplicate detection. It uses a separate document viewer especially to review 'ND' similarity. As shown below, documents are organized into separate groups listed in the top left pane, and the individual documents for selected groups are shown in the pane to the right.

The bottom pane displays selected documents side by side in a 'difference viewer'. The top document in the list will be the 'base' and a document selected below will be shown to the right of it for comparison.

The options to highlight differences or remove whitespace can be toggled on and off. Documents in the same family as the selected document are shown in the pane at the bottom left. The document list allows you to easily find similar documents which have been tagged for responsiveness or privilege inconsistently.

An admin creates ND groups in Viewpoint's View Manager, which is available in the Tools menu, and can be used to create views based on several different criteria. A wizard is used to build near duplicates for the complete project. The default threshold is 95, but this can be adjusted to generate groups of higher or lower similarity.

View Manager will also give you the option to exclude documents which are missing hash values or certain key metadata fields. Repeated content such as confidentiality footers can be excluded from the comparison by checking the option to 'Apply/Define text to be ignored when building ND', and adding different blocks of text.